From 5776af96f17d8eaea204ad5158f9256e8f9172e1 Mon Sep 17 00:00:00 2001
From: Matt Simerson <matt@tnpi.net>
Date: Thu, 15 Oct 2026 21:08:32 -0700
Subject: [PATCH] user: keep usernames out of console format strings

console.warn and console.error treat their first argument as a format
string. With the username interpolated into it, a username holding %o or
%s consumed the error argument, so the log showed the username wrapped
around the error and dropped the error itself. The username is now a %s
argument (CodeQL js/tainted-format-string, alerts 25-27).
---
 lib/user/credentials.js | 2 +-
 lib/user/store/file.js  | 2 +-
 lib/user/store/mysql.js | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/user/credentials.js b/lib/user/credentials.js
index 0c570f6..0515313 100644
--- a/lib/user/credentials.js
+++ b/lib/user/credentials.js
@@ -105,7 +105,7 @@ class Credentials {
         try {
           hashed = await this.hashAuthPbkdf2(passTry, salt, storedIters)
         } catch (err) {
-          console.error(`PBKDF2 failed for user ${username}`, err)
+          console.error('PBKDF2 failed for user %s', username, err)
           return invalid
         }
 
diff --git a/lib/user/store/file.js b/lib/user/store/file.js
index e6f8d08..f0b6318 100644
--- a/lib/user/store/file.js
+++ b/lib/user/store/file.js
@@ -78,7 +78,7 @@ class UserRepoFile extends UserBase {
               Object.assign(row, upgraded)
             })
           } catch (err) {
-            console.warn(`password hash upgrade failed for user ${authTry.username}`, err)
+            console.warn('password hash upgrade failed for user %s', authTry.username, err)
           }
         }
 
diff --git a/lib/user/store/mysql.js b/lib/user/store/mysql.js
index 7e53c08..b40b6aa 100644
--- a/lib/user/store/mysql.js
+++ b/lib/user/store/mysql.js
@@ -52,7 +52,7 @@ class UserRepoMySQL extends UserBase {
             const creds = await Credentials.forStorage(authTry.password)
             await Mysql.execute(...Mysql.update('nt_user', { nt_user_id: u.id }, creds))
           } catch (err) {
-            console.warn(`password hash upgrade failed for user ${authTry.username}`, err)
+            console.warn('password hash upgrade failed for user %s', authTry.username, err)
           }
         }
         for (const f of ['password', 'pass_salt']) {