fix: code changes for resolving Critical and High vulnerabilities in the security tab of DKM repo.

[Akhileswara-Microsoft]

Purpose

• ...

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• ...

Other Information

[Copilot]

Pull request overview

This pull request addresses Critical and High security vulnerabilities identified in the DKM repository's security tab. The changes focus on preventing log injection attacks and improving secure random number generation.

Key Changes:

• Implements log injection prevention across C# logging statements by sanitizing carriage return (\r) and newline (\n) characters from user-controlled input before logging
• Replaces insecure Math.random()-based UUID generation with cryptographically secure crypto.getRandomValues() implementation in the frontend
• Adds X-Frame-Options: DENY security header to prevent clickjacking attacks

Reviewed changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated 27 comments.

Show a summary per file

File	Description
App/kernel-memory/service/Service.AspNetCore/WebAPIEndpoints.cs	Sanitizes index names, document IDs, and filenames in log statements to prevent log injection
App/kernel-memory/service/Core/Pipeline/InProcessPipelineOrchestrator.cs	Sanitizes pipeline index and document ID in error and info logs
App/kernel-memory/service/Core/Pipeline/BaseOrchestrator.cs	Sanitizes pipeline identifiers in debug logs
App/kernel-memory/service/Core/Handlers/TextPartitioningHandler.cs	Sanitizes pipeline identifiers in debug and warning logs
App/kernel-memory/service/Core/Handlers/TextExtractionHandler.cs	Sanitizes pipeline identifiers in debug logs
App/kernel-memory/service/Core/Handlers/SummarizationParallelHandler.cs	Sanitizes pipeline identifiers in debug logs
App/kernel-memory/service/Core/Handlers/SummarizationHandler.cs	Sanitizes pipeline identifiers in debug logs
App/kernel-memory/service/Core/Handlers/SaveRecordsHandler.cs	Sanitizes pipeline identifiers, record IDs, and index names across multiple log statements
App/kernel-memory/service/Core/Handlers/KeywordExtractingHandler.cs	Sanitizes pipeline identifiers in debug logs
App/kernel-memory/service/Core/Handlers/GenerateEmbeddingsParallelHandler.cs	Sanitizes pipeline identifiers and generator type names in trace logs
App/kernel-memory/service/Core/Handlers/GenerateEmbeddingsHandlerBase.cs	Sanitizes pipeline identifiers and sub-step names in trace logs
App/kernel-memory/service/Core/Handlers/GenerateEmbeddingsHandler.cs	Sanitizes pipeline identifiers and generator type names in trace logs
App/kernel-memory/service/Core/Handlers/DeleteIndexHandler.cs	Sanitizes pipeline identifiers in debug logs
App/kernel-memory/service/Core/Handlers/DeleteGeneratedFilesHandler.cs	Sanitizes pipeline identifiers in debug logs
App/kernel-memory/service/Core/Handlers/DeleteDocumentHandler.cs	Sanitizes pipeline identifiers in debug logs
App/kernel-memory/service/Core/FileSystem/DevTools/VolatileFileSystem.cs	Sanitizes file paths in error logs
App/kernel-memory/service/Core/FileSystem/DevTools/DiskFileSystem.cs	Sanitizes file paths in warning, trace, error, and debug logs
App/kernel-memory/service/Core/DocumentStorage/DevTools/SimpleFileStorage.cs	Sanitizes index, document ID, and filename in error logs
App/kernel-memory/extensions/Elasticsearch/Elasticsearch/ElasticsearchMemory.cs	Sanitizes search text, index names, and filter debug strings in trace logs
App/kernel-memory/extensions/AzureBlobs/AzureBlobsStorage.cs	Sanitizes blob names, file paths, and prefixes in various log levels
App/kernel-memory/extensions/AzureAISearch/AzureAISearch/AzureAISearchMemory.cs	Sanitizes record IDs and index names in debug and trace logs
App/kernel-memory/extensions/AWS/S3/AWSS3Storage.cs	Sanitizes index names, object keys, and prefixes in trace, warning, and info logs
App/frontend-app/src/components/documentViewer/pageNumberTab.tsx	Implements URL sanitization to prevent CRLF injection in storage URLs
App/frontend-app/src/components/chat/chatRoom.tsx	Replaces insecure UUID generation with cryptographically secure implementation using Web Crypto API
App/frontend-app/public/web.config	Adds X-Frame-Options header to prevent clickjacking attacks

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 25 out of 25 changed files in this pull request and generated 10 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.