fix(event-publisher): sanitise untrusted values before logging

[perezmlal]

Closes CodeQL alert #3 — py/log-injection (CWE-117).

The flagged line was already safe

The alert points at app.logger.info("key: %s", key), where key is built from the sub_service, sub_service_group and geohash path parameters. All three are allowlist-validated a few lines earlier: GEOHASH_RE and SUB_SERVICE_GROUP_RE cannot match CR or LF, and sub_service must pass a set-membership check. CodeQL does not model regex-match guards as taint barriers, so it reports the flow regardless.

The scan missed a real one three lines below

app.logger.warning("Encoding failed: %s", exc) logs the asn1tools EncodeError message, which embeds field names and values taken from the request JSON body. That body is only checked for being a dict — its contents are never validated, and the error message can carry raw CR/LF.

Verified end-to-end against a real ASN.1 encoder. Against the unpatched service:

$ curl -X POST localhost:5000/api/publish/denm/public/7y0191k4 \
    -H 'Content-Type: application/json' \
    -d '{"header":"x\r\n2026-01-01 00:00:00,000 CRITICAL EventPublisher : FORGED ENTRY"}'

app.log gains a fully-formed forged entry, indistinguishable from a genuine one:

2026-08-10 23:24:26,686 WARNING EventPublisher waitress-0 : Encoding failed: DENM.header: Expected data of type dict, but got x
2026-01-01 00:00:00,000 CRITICAL EventPublisher : FORGED ENTRY.

With the fix, the same request stays on one line:

2026-08-10 23:24:06,151 WARNING EventPublisher waitress-0 : Encoding failed: DENM.header: Expected data of type dict, but got x2026-01-01 00:00:00,000 CRITICAL EventPublisher : FORGED ENTRY.

Changes

• New sanitize_for_log() in EventPublisher.py: strips C0/C1 control characters and DEL, and truncates to LOG_VALUE_MAX_LENGTH (default 256, overridable via config, following the existing getattr(config, ...) pattern) so a large payload cannot flood the log.
• Applied at both user-derived sinks. The other log calls are untouched: two report Kafka broker state, one is a constant, and one logs a hexlify output.
• Six tests, including a regression test that drives the EncodeError path and asserts the emitted record contains no line break.
• CHANGELOG.md entry under Unreleased → Security.

Note for reviewers

The trailing .replace("\r", "").replace("\n", "") is redundant with the regex that precedes it. It is deliberate and load-bearing: it is the sanitisation pattern CodeQL's py/log-injection query recognises as a taint barrier. Removing it as a simplification reopens the alert. There is a comment saying so at the call site.

Verification

Check	Result
pytest --cov-fail-under=80	17 passed, 91.86% coverage
ruff check	All checks passed
bandit -r	No issues identified
End-to-end forgery repro	Reproduced unpatched, blocked patched

Alert closure is confirmed by this PR's Analyze (python) run, since no CodeQL CLI is available locally.