Keep each log entry of the module on one line

LoggerService wrote the message as given and the context with
var_export(), which keeps line breaks, and SimpleSAMLphp's logger writes
what it is given. So a value sent in a request could add lines of its
own to the OP's log, at levels the shipped configuration writes. It takes
only a client ID and a redirect URI: ScopeRule logs ignored scope values
at notice even for a request it accepts, CodeChallengeMethodRule and
ClientRedirectUriRule log what they refuse, and ErrorResponder logs a
hint which can quote the request. 32f5929 closed this on the client
authentication path only.

Fix it in LoggerService, which the openid library logs through too, and
every line of the module except three in the cron hook, which hold
exception messages from its own steps. The context is now one line of
JSON, which keeps a line break in a value as its escape, and control
characters, format characters such as bidirectional overrides, and the
line and paragraph separators left in the line give way to a space. A
line which is not valid UTF-8 keeps printable ASCII only.

An object in the context is written as var_export() writes it, as text
in the JSON. JSON would write the Result and response mode objects which
AuthCodeGrant logs as {}, and would run jsonSerialize().

The log format changes, so the upgrade guide says so. The resolver's
forLog() stays, for its 1,000-byte bound.

Assisted-by: Claude Code (claude-opus-5-5, implementation & unit tests)
Assisted-by: OpenAI Codex (gpt-6.1-sol, xhigh review)
Assisted-by: Google Antigravity (gemini-3.8-flash-high, review)

Author: cicnavi

docs/6-oidc-upgrade.md

@@ -411,6 +411,13 @@ attribute, clients relying on the previously inconsistent value may see a
 changed `sub` in flows where the claims were not released.
 - Logging has been improved for authentication flows. It should now be easier
 to find information about what went wrong by looking at the relevant log entries.
+- Each log entry of the module now stays on one line, so that a value sent in a
+request can not add lines of its own to the log. The context of an entry is
+no longer written in the multi-line `var_export()` format, but as JSON, which
+keeps line breaks in its values as escapes. Anything left which could break the
+line or disguise the text (control characters, format characters such as
+bidirectional overrides) is replaced with a space. If you parse these log
+entries, adjust your parser.
 
 New configuration options:
 

src/Services/LoggerService.php

@@ -12,51 +12,71 @@
 
 class LoggerService implements LoggerInterface
 {
+    /**
+     * What a line of the log may not hold: control characters, among them the C0 line breaks and U+0085, format
+     * characters, among them the bidirectional overrides which make text read in another order, and the line and
+     * paragraph separators. A run of them gives way to one space.
+     */
+    protected const string NOT_IN_A_LOG_LINE = '/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]+/u';
+
+    /**
+     * The same for a line which is not valid UTF-8, which the pattern above can not read: only printable ASCII stays.
+     */
+    protected const string NOT_IN_A_LOG_LINE_WHICH_IS_NOT_UTF8 = '/[^\x20-\x7E]+/';
+
+    /**
+     * Text stays readable, and a context which can not be encoded in full is written as far as it can be: a value of
+     * another kind should not cost the whole log entry.
+     */
+    protected const int CONTEXT_ENCODING = JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE |
+    JSON_INVALID_UTF8_SUBSTITUTE | JSON_PARTIAL_OUTPUT_ON_ERROR;
+
+
     public function emergency(string|Stringable $message, array $context = []): void
     {
-        Logger::emergency((string)$message . ($context ? " " . var_export($context, true) : ""));
+        Logger::emergency($this->asOneLine($message, $context));
     }
 
 
     public function alert(string|Stringable $message, array $context = []): void
     {
-        Logger::alert((string)$message . ($context ? " " . var_export($context, true) : ""));
+        Logger::alert($this->asOneLine($message, $context));
     }
 
 
     public function critical(string|Stringable $message, array $context = []): void
     {
-        Logger::critical((string)$message . ($context ? " " . var_export($context, true) : ""));
+        Logger::critical($this->asOneLine($message, $context));
     }
 
 
     public function error(string|Stringable $message, array $context = []): void
     {
-        Logger::error((string)$message . ($context ? " " . var_export($context, true) : ""));
+        Logger::error($this->asOneLine($message, $context));
     }
 
 
     public function warning(string|Stringable $message, array $context = []): void
     {
-        Logger::warning((string)$message . ($context ? " " . var_export($context, true) : ""));
+        Logger::warning($this->asOneLine($message, $context));
     }
 
 
     public function notice(string|Stringable $message, array $context = []): void
     {
-        Logger::notice((string)$message . ($context ? " " . var_export($context, true) : ""));
+        Logger::notice($this->asOneLine($message, $context));
     }
 
 
     public function info(string|Stringable $message, array $context = []): void
     {
-        Logger::info((string)$message . ($context ? " " . var_export($context, true) : ""));
+        Logger::info($this->asOneLine($message, $context));
     }
 
 
     public function debug(string|Stringable $message, array $context = []): void
     {
-        Logger::debug((string)$message . ($context ? " " . var_export($context, true) : ""));
+        Logger::debug($this->asOneLine($message, $context));
     }
 
 
@@ -80,4 +100,34 @@ public static function getInstance(): self
     {
         return new self();
     }
+
+
+    /**
+     * A message and its context as the one line they are written on. Both often hold what a request sent, whether or
+     * not the request goes on to be accepted, and SimpleSAMLphp's logger writes what it is given, so a line break in
+     * such a value would let the sender add lines of their own to the log. The context is JSON, which writes C0
+     * control characters, U+2028 and U+2029 as escapes, so a value holding those can still be read, and what is left
+     * of the disallowed characters gives way to a space.
+     *
+     * An object in the context is written as var_export() writes it, as text in the JSON: with its private properties
+     * and without running any of its code, where JSON would show its public properties only, or whatever its
+     * jsonSerialize() answers or throws.
+     */
+    protected function asOneLine(string|Stringable $message, array $context): string
+    {
+        $line = (string)$message;
+
+        if ($context !== []) {
+            array_walk_recursive($context, static function (mixed &$value): void {
+                if (is_object($value)) {
+                    $value = var_export($value, true);
+                }
+            });
+
+            $line .= ' ' . (string)json_encode($context, self::CONTEXT_ENCODING);
+        }
+
+        return preg_replace(self::NOT_IN_A_LOG_LINE, ' ', $line) ??
+        (string)preg_replace(self::NOT_IN_A_LOG_LINE_WHICH_IS_NOT_UTF8, ' ', $line);
+    }
 }

tests/integration/src/Flows/ConfidentialClientTokenEndpointTest.php

@@ -440,7 +440,7 @@ protected function tokenRequest(array $params): ServerRequest
     /**
      * The reason for the refusal is in the log, and what it quotes did not get a line of its own: every entry holding
      * the text is short, has it joined to what came before it, and has no line break or other control character ahead
-     * of it. The entry may have line breaks after it, as LoggerService writes the context there with var_export().
+     * of it.
      */
     protected function assertForgedLineLoggedAsPartOfTheReason(string $expectedQuote): void
     {