From 78cea29871c326ee55bae3c1fb5a90fb6acce3fa Mon Sep 17 00:00:00 2001 From: Matt Davis Date: Tue, 15 Sep 2026 09:01:06 -0400 Subject: [PATCH 1/3] Apply suggested fix to src/web/api_handlers_audit.c from Copilot Autofix Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> --- src/web/api_handlers_audit.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/web/api_handlers_audit.c b/src/web/api_handlers_audit.c index 2ce9aa9b..2bf9734e 100644 --- a/src/web/api_handlers_audit.c +++ b/src/web/api_handlers_audit.c @@ -391,7 +391,11 @@ void handle_put_audit_settings(const http_request_t *req, if (retention) { int previous_days = AUDIT_RETENTION_DEFAULT_DAYS; - db_audit_get_retention_days(&previous_days); + if (db_audit_get_retention_days(&previous_days) != 0) { + cJSON_Delete(body); + http_response_set_json_error(res, 500, "Failed to load audit settings"); + goto unlock_and_return; + } if (db_audit_set_retention_days(retention_days) != 0) { cJSON_Delete(body); http_response_set_json_error(res, 500, "Failed to save audit settings"); From fb4abf0241600720675400d087ec7ef98ed259b9 Mon Sep 17 00:00:00 2001 From: Matt Davis Date: Tue, 15 Sep 2026 09:01:07 -0400 Subject: [PATCH 2/3] Apply suggested fix to src/web/api_handlers_audit.c from Copilot Autofix Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> --- src/web/api_handlers_audit.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/src/web/api_handlers_audit.c b/src/web/api_handlers_audit.c index 2bf9734e..b49a8628 100644 --- a/src/web/api_handlers_audit.c +++ b/src/web/api_handlers_audit.c @@ -188,9 +188,16 @@ void handle_get_audit_events(const http_request_t *req, http_response_t *res) { static void csv_cell(FILE *stream, const char *value) { fputc('"', stream); - if (value && strchr("=+-@", value[0])) { - /* Keep spreadsheet applications from interpreting exported cells. */ - fputc('\'', stream); + if (value) { + const char *cursor = value; + while (*cursor && + ((unsigned char)*cursor <= 0x20 || (unsigned char)*cursor == 0x7f)) { + cursor++; + } + if (strchr("=+-@", *cursor)) { + /* Keep spreadsheet applications from interpreting exported cells. */ + fputc('\'', stream); + } } for (const char *cursor = value ? value : ""; *cursor; cursor++) { if (*cursor == '"') fputc('"', stream); From 9fb0fbc0cd6c6ac15fdb122996253de809871a31 Mon Sep 17 00:00:00 2001 From: Matt Davis Date: Tue, 15 Sep 2026 09:22:01 -0400 Subject: [PATCH 3/3] Add null check for cursor in api_handlers_audit.c Ensure cursor is not null before checking character. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- src/web/api_handlers_audit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/web/api_handlers_audit.c b/src/web/api_handlers_audit.c index b49a8628..8216ca5b 100644 --- a/src/web/api_handlers_audit.c +++ b/src/web/api_handlers_audit.c @@ -194,7 +194,7 @@ static void csv_cell(FILE *stream, const char *value) { ((unsigned char)*cursor <= 0x20 || (unsigned char)*cursor == 0x7f)) { cursor++; } - if (strchr("=+-@", *cursor)) { + if (*cursor && strchr("=+-@", *cursor)) { /* Keep spreadsheet applications from interpreting exported cells. */ fputc('\'', stream); }