[FEATURE] Security review of 3.0 #157

Problem / Use Case

The last full security audit covered 2.4.0 (docs/security-reviews/2026-04-18-claude-security-audit-v2.4.0.md). 3.0 rewrote logging.sh in POSIX sh and replaced every validator and sanitizer. Golden results recorded from 2.7.0 show the behaviour is unchanged for the tested inputs, but the protections haven't been reviewed as code since 2.4.0.

Proposed Solution

Run the per-version review with the security-review skill against the 3.0.0 tag. Save the report in docs/security-reviews/, and file any findings with scripts/create-issues.sh.

Report anything exploitable through a private advisory, as SECURITY.md says, not as an issue.

Cover at least:

• Sanitizers: _sanitize_log_message_into, _strip_ansi_codes_into, _replace_line_control_chars, and the tr fast path for long messages and its fallback.
• Validators: the POSIX replacements for the bash regexes, including the case bracket expressions. The BusyBox 1.37 bug fixed during 3.0 came from a bracket expression built from a quoted variable that contained -, so look for the same pattern elsewhere.
• Shell detection: _LOGGER_SHELL_FAMILY, and that inherited BASH_VERSION or ZSH_VERSION values can't change it.
• Read-only constants: _logger_readonly, including zsh sourced from a function.
• Message handling: the save and restore of result variables in _log_message, including that no message text, and no log_sensitive text, is left in variables.
• Logger validation: _find_and_validate_logger, especially the BusyBox symlink exception. It must not accept a chain of links through an unsafe directory.
• Timestamps: the eval strings in _zsh_timestamp_into, which must stay constants, and _utc_timestamp_from_epoch.
• Config parser: the POSIX rewrite, including the BOM, CRLF and quote handling.
• Variables from the environment: every internal _LOGGER_* value must be set on each source.

Alternatives Considered

A review of only the 3.0 diff. The rewrite touched almost every line, so a full review costs little more.

Additional Context

• The zsh log injection fixed in 3.0 is described in its security advisory. Check that the fix covers every place that prints data.
• The independent review during 3.0 found wrong zsh UTC timestamps, a silent exit under set -e with a readonly TZ, and a swappable symlink chain in the BusyBox logger exception. All were fixed before merge, with regression tests in tests/test_posix_compat.sh. Check that those tests still cover each finding.

Implementation Ideas (Optional)

Run the review and the fixes in separate sessions, so the review isn't marking work its own session wrote.

Related Issues

• [BUG] Journal tag validation misses bidi and non-UTF-8-locale controls, and overlong config tags skip sanitising #154 is a known finding from the 3.0.0 re-review of PR feat(logging)!: support POSIX sh (dash, busybox ash) #147: journal tag validation misses bidi controls, and C1 controls outside a UTF-8 locale. Record it in the report rather than filing it again, and check whether other validators share the gap.
• [FEATURE] Check readonly variables without starting grep, to cut start-up time #159 replaces _is_readonly, which the read-only constants and the environment-override protection depend on. If it merges before this review, include its eval lines and name check.