Skip to content

feat: add Sanitization feature family and feature-enabled WebSample - #54

Merged
marioarce merged 72 commits into
mainfrom
develop
Jul 23, 2026
Merged

feat: add Sanitization feature family and feature-enabled WebSample#54
marioarce merged 72 commits into
mainfrom
develop

Conversation

@marioarce

Copy link
Copy Markdown
Owner

Summary

This PR brings the latest develop changes into main, centered on the new Sanitization feature family and related platform updates.

What’s Included

  • Adds the Sanitization feature family with abstractions, engine, options, DI registration, no-op fallback, and public sanitization extensions
  • Adds comprehensive Sanitization test coverage for log injection, file path traversal, sensitive data masking, regex safety, result models, and feature wiring
  • Wires the WebSample app into the Features Framework and adds cache and sanitization demo endpoints
  • Updates package/version management to include an independent Sanitization version family and release workflow support
  • Expands documentation across the README, changelog, package READMEs, workflow guidance, and repository-specific AI operating guidance
  • Includes core library improvements such as additional collection and string extension coverage and related test updates

Notes

  • develop is ahead of main by 72 commits
  • The main functional addition is the new Sanitization feature set, with supporting sample, test, CI, and documentation updates bundled in the branch

marioarce and others added 30 commits June 22, 2026 15:32
 - Add marketing/ to .gitignore
 - Untrack all previously committed marketing files (files remain on disk locally)
 - Updated all README files to use absolute GitHub URLs for PowerCSharp banner images
 - Changed from relative paths to raw.githubusercontent.com URLs for consistent rendering
 - Added banner images to Features package READMEs that were missing them
 - Updated Core and Extensions package READMEs to use absolute URLs instead of relative paths
 - Ensures banner images display correctly across all documentation platforms
docs: standardize banner image references to absolute GitHub URLs
 - Deleted UnitTest1.cs from PowerCSharp.Core.Tests containing StringExtensionsTests
 - Deleted UnitTest1.cs from PowerCSharp.Utilities.Tests containing placeholder test
 - Cleaned up test projects by removing obsolete test files
 - Added DistinctBy method that removes duplicates based on a key selector function
 - Maintained null safety and improved code readability
 - Added comprehensive XML documentation for the new DistinctBy method
 - Created ListExtensionsTests.cs with full test coverage for ListExtensions methods
 - Added 8 tests for DistinctBy method covering null, empty, duplicates, complex types, and order preservation
 - Added 5 tests for DeepClone method covering null, empty, cloneable items, null items, and modification independence
 - Included test helper classes TestPerson and TestCloneable to support test scenarios
 - Ensures robust validation of ListExtensions functionality
 - Created StringExtensionsTests.cs with full test coverage for string extension methods
 - Added 4 tests for IsNullOrWhiteSpace covering null, empty, whitespace, and valid strings
 - Added 5 tests for SafeSubstring covering valid parameters, invalid indices, null strings, and boundary conditions
 - Added 5 tests for ToTitleCase covering normal conversion, empty strings, null strings, single words, and multiple spaces
 - Ensures robust validation of string extension functionality
 - Changed expected exception from ArgumentNullException to NullReferenceException
 - Corrected test to properly validate null reference behavior when calling TryAdd on null dictionary
 - Aligns test expectations with actual runtime behavior of null reference operations
 - Updated all test method calls from MathHelper to MathUtility
 - Changed Clamp, IsInRange, Percentage, ToRadians, ToDegrees, IsEven, and IsOdd method references
 - Maintains all existing test logic while using the corrected class name
 - Aligns tests with the actual class name in the codebase
 - Changed ValidationHelper references to ValidationUtility in test methods
 - Updated IsNumeric method calls to use the correct class name
 - Maintains all existing test logic while using the proper class name
 - Aligns tests with the actual ValidationUtility class in the codebase
 - Added PowerCSharp.Extensions project reference to PowerCSharp.Core.Tests.csproj
 - Reformatted ItemGroup tags in BuiltInFeatures.Tests.csproj for consistency
 - Reformatted ItemGroup tags in Features.Tests.csproj for consistency
 - Reformatted ItemGroup tags in Utilities.Tests.csproj for consistency
 - Ensures Core.Tests can access extension methods from PowerCSharp.Extensions
 - Added PowerCSharp.Core.Tests project to solution with Debug and Release configurations
 - Added PowerCSharp.Compatibility.Extensions.Tests project to solution with Debug and Release configurations
 - Added PowerCSharp.Utilities.Tests project to solution with Debug and Release configurations
 - Configured nested project structure to place all three test projects under Tests folder
 - Ensures test projects are included in solution build and navigation
 - Added Coalesce extension method that returns fallback value when raw value is null or empty
 - Method takes nullable string rawValue and nullable string fallback parameters
 - Returns rawValue when it has content, otherwise returns fallback
 - Includes comprehensive XML documentation for the new method
 - Provides convenient null-coalescing behavior for string values
 - Created StringExtensionsTests.cs with full test coverage for the new Coalesce method
 - Added 7 tests covering null, empty, whitespace, and various null/empty combinations
 - Tests verify that Coalesce returns rawValue when it has content and fallback when rawValue is null or empty
 - Includes edge case tests for null fallback, both null, and both empty scenarios
 - Ensures robust validation of the Coalesce string extension method
 - Added matrix strategy with ubuntu-latest and windows-latest operating systems
 - Changed runs-on to use matrix.os instead of hardcoded ubuntu-latest
 - Enables cross-platform testing for both Linux and Windows environments
 - Ensures code compatibility across different operating systems
…ions.Tests from solution

 - Reverted build-and-test job to use single ubuntu-latest runner instead of matrix strategy
 - Removed PowerCSharp.Compatibility.Extensions.Tests project from solution file
 - Cleaned up build configurations for the removed test project
 - Simplified CI configuration to use single platform for testing
extensions: add DistinctBy and Coalesce extension methods with comprehensive test coverage
 - Define non-negotiable architectural and workflow rules for AI coding agents
 - Document package topology, dependency-isolation constraints, and version-family boundaries
 - Establish structured response formatting, communication standards, and build/test/pack commands
 - Add index of nested project guidance for sensitive and feature-specific areas
 - Add standardized procedures for extending core libraries with tests, docs, and changelog updates
 - Document end-to-end workflow for creating new pluggable feature packages with dependency isolation and version-family setup
 - Define release preparation and publishing checklist, including branching, versioning, CI/CD dispatch, and post-release verification
…chitecture

 - Define high-sensitivity operating constraints for the Features engine and module lifecycle
 - Document two-tier feature model and strict dependency-direction rules across abstractions, engine, built-in, and pluggable packages
 - Capture engine internals and invariants for module discovery, flag provider precedence, and module self-gating behavior
 - Add implementation guardrails for future pluggable features and clarify current Sitecore roadmap status
…nternals

 - Document locking model across in-process and cross-process paths, including mutex scope and gating
 - Define atomic write and index persistence invariants to prevent unsafe refactors
 - Capture known concurrency and durability hazards, including mutex growth and cross-process factory behavior
 - Add modification guardrails requiring multi-process validation and explicit risk callouts
…amework support

 - Define high-sensitivity constraints and backward-compatibility expectations for active production consumers
 - Document framework-specific architecture, language-version pinning, and dependency boundaries unique to this package
 - Capture CI coverage gap and required manual validation workflow for compatibility changes
 - Clarify release-versioning path and maintainer decision points for compatibility package publishing
docs: add AI agent governance layer (CLAUDE.md files + Workflows SOP)
…elop

# Please enter a commit message to explain why this merge is necessary,
# especially if it merges an updated upstream into a topic branch.
#
# Lines starting with '#' will be ignored, and an empty message aborts
# the commit.
 - Add the machine-specific VS Code settings file to ignore rules
 - Remove the exception that previously allowed that settings file to be tracked
- add new class library targeting netstandard2.0 and net8.0 for the sanitization feature abstractions
- reference logging abstractions and system.text.json packages needed by the engine
- bind package version to the upcoming sanitization feature version property
- add sanitization type enum covering log injection, file path, sensitive data and regex injection
- add sanitization strategy enum for control character handling (remove, replace, html/url/json encode)
- add sensitive data detection strictness enum (low, medium, high)
- add mutable sanitization settings type covering log, file path, sensitive data and regex options
- add sanitization result type representing unchanged, modified and rejected outcomes
- add sensitive data result type representing unchanged and modified outcomes
- model these as plain classes with manual equality rather than records, matching the existing cache feature abstractions convention for netstandard2.0 compatibility
- add the dependency-injection facing sanitization service contract covering log injection, file path, sensitive data and regex injection
- add the settings provider contract bridging host configuration into the static engine
- expose all four sanitization operations symmetrically through the service contract
- add the shared static engine state: configuration provider wiring, security event logger, performance tracking
- add shared control character classification used by both log injection and file path validation
- add a netstandard2.0 safe contains helper since the string contains overload with string comparison is not available on that target
- add performance statistics reporting covering all four sanitization types
marioarce and others added 24 commits July 22, 2026 18:45
 - Fix sensitive key masking to preserve the key name and mask only the value
 - Replace a reference to a non-existent capture group that always produced an empty mask and silently left the raw secret in the output
 - Align the fix with the pattern already used by the other key based heuristics in the same method
 - Add an xunit test project referencing the Sanitization module and abstractions packages
 - Disable test parallelization since the sanitization engine holds process wide static state that a subset of tests configure directly
 - Cover null and empty input passthrough
 - Cover the disabled setting bypass
 - Cover each control character strategy including tab preservation
 - Cover the max sanitized string length truncation
 - Cover strict allowlist validation for traversal, absolute paths, and reserved device names
 - Cover the extension and base directory allowlists including an escape attempt
 - Cover legacy pattern stripping mode
 - Cover correlation id sanitization for safe file name use
 - Cover masking of key value pairs, bearer tokens, api keys, and file paths
 - Verify the key or prefix is preserved while only the value is masked
 - Cover strictness level differences for long alphanumeric strings
 - Cover the custom mask character setting
 - Cover acceptance of safe patterns and rejection of invalid syntax
 - Cover nested quantifier rejection and the explicit opt in override
 - Cover the pattern length limit and each individually disallowed construct
 - Cover the disabled setting bypass
 - Cover every string extension method including the throwing strict file path variant
 - Cover both mask overloads and the short value edge case
 - Cover factory methods and value equality for both result types
 - Cover explicit registration resolving the real service and settings provider
 - Cover options binding from configuration and the settings provider reflecting it
 - Cover the DI resolved service honoring bound options
 - Cover the NoOp service passthrough behavior
 - Cover bridging the resolved settings provider into the static engine, including the no provider case
 - Add the Sanitization feature test project to the main solution
 - Nest the project under the existing tests solution folder
 - Register the project across all solution configuration platforms
 - Rename the misspelled property to the one actually defined on the attribute
 - Resolves a compilation error in the test assembly attribute
 - Assert against characters that are invalid file name characters on every platform
 - Avoid asserting on characters that are only invalid on Windows since the prior assertion failed on this machine
test(sanitization): add comprehensive test suite for sanitization feature
 - Document the engine, extension methods, contracts, and NoOp implementation
 - Show standalone usage with no DI or configuration required
 - List package details and dependencies
 - Document the feature module, options, service, and explicit registration extension
 - Show both auto discovery and explicit registration usage
 - Explain the departure from the cache family NoOp floor pattern
 - Document the package family overview and dependency direction
 - Detail the engine, result types, settings, and enums
 - Detail the module, options, service, and explicit registration extension
 - Cover two layer gating and provide a full host integration example
 - Add nuget badges for both sanitization packages
 - Add the sanitization feature family package table entries and installation snippet
 - Add a usage example and update target frameworks and documentation links
 - Document both new packages and the comprehensive test suite under unreleased
 - Note the new independent version family
 - Document the sensitive data masking fix found while writing tests
docs(sanitization): add comprehensive documentation for Sanitization feature family
 - Add project references to the Features engine and its abstractions
 - Add project references to the Cache feature and BitFaster provider
 - Add project references to the Sanitization feature and its abstractions
 - Register the Features Framework via auto discovery, opting in the Cache and Sanitization modules
 - Register the BitFaster cache provider so the cache demo has an active backend
 - Run the Features Framework pipeline hook after building the app
 - Map new demo endpoints for the cache and sanitization features
 - Demonstrate a cache miss followed by a set and hit round trip
 - Resolve the cache service via dependency injection
 - Demonstrate log injection, file path traversal, sensitive data masking, and regex injection sanitization
 - Resolve the sanitization service via dependency injection
 - Add a PowerFeatures configuration section enabling both features
 - Configure the BitFaster provider and capacity for the cache demo
feat(websample): add Cache and Sanitization feature demonstrations
@marioarce marioarce self-assigned this Jul 23, 2026
@marioarce
marioarce merged commit e5cc208 into main Jul 23, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Epic] Sanitization Feature — log injection, path traversal, sensitive-data & regex-injection prevention

1 participant