Potential fix for code scanning alert no. 4: Log entries created from user input

[grokify]

Potential fix for https://github.com/plexusone/agentkit/security/code-scanning/4

In general, the fix is to sanitize or encode user-provided values before logging them so that they cannot inject new log entries or otherwise break log structure. For plain-text logs, the minimal protection is to strip newline (\n) and carriage return (\r) characters from user-controlled strings prior to logging.

For this specific case, we want to keep the existing logging behavior (still log the session ID) but ensure that req.SessionID cannot inject extra lines. The best minimally invasive fix is to create a local sanitized copy of req.SessionID inside handleInvocations right before it is logged, replacing \n and \r with empty strings using the standard strings package, and log that sanitized value instead. We need to add an import of "strings" to platforms/agentcore/server.go to support this, without changing existing imports otherwise.

Concretely:

• In platforms/agentcore/server.go, update the import block to include strings.
• In handleInvocations, just before or inside the log statement at lines 133–135, create a variable like safeSessionID := strings.ReplaceAll(strings.ReplaceAll(req.SessionID, "\n", ""), "\r", "") and then pass safeSessionID to log.Printf instead of req.SessionID.

No other behavior or control flow needs to change.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.