[Bug]: Accept unsanitized user input.

[kstij1]

Overview
The Google Calendar integration logs unsanitized user-supplied data ,This compromises the integrity of log files, making them unreliable for debugging, monitoring.

Affected Endpoint and Files

• File: ai-python/src/MCP/google/gcalendar/calendar_tools.py
• Function: create_event (logging attachment URLs and file IDs)
• Line(s): ~286–290

Evidence

for att in attachments:
    match = re.search(r"(?:/d/|/file/d/|id=)([\w-]+)", att)
    file_id = match.group(1) if match else None
    logger.info(f"[create_event] Extracted file_id '{file_id}' from attachment URL '{att}'")

Steps to Reproduce

1. Supply a crafted attachment URL that includes newline/control characters:
   att = "https://drive.google.com/open?id=12345\nINFO: user=admin logged in

2. When create_event runs, the log file will contain:

[create_event] Extracted file_id '12345' from attachment URL 'https://drive.google.com/open?id=12345
INFO: user=admin logged in'

3. The INFO: user=admin logged in appears as a legitimate new log entry, misleading anyone reviewing the logs.

Expected Behavior

All user-supplied inputs should be sanitized or escaped before being logged.  input must not alter the structure or semantics of log files.

Impact

Integrity risk: Attackers can pollute logs, making investigations and audits unreliable.
Operational risk: Security alerts, monitoring systems, and compliance reports relying on logs can be bypassed.
Severity: Medium –  requires log access, but integrity of logs is critical in production systems.

[github-actions]

:Thanks for reporting a potential security issue!

For security-related reports, please do not use public issues.

🔒 You can report vulnerabilities via:

• 📧 Email: hello@weam.ai
• 📄 Security Policy: SECURITY.md

This issue has been closed automatically to protect sensitive information. We’ll respond quickly through the private channels above.

[SaxenaPrashast]

I have submitted a pull request titled [Bug]:#76 - Fix log injection in create_event by sanitizing attachment URLs before logging addressing the issue of unsanitized user input in Google Calendar event creation logs.

Summary of the fix:

• Added a helper function sanitize_log_input to escape newline and carriage return characters in user-supplied attachment URLs.
• Applied this sanitization function before logging attachments and file IDs to prevent log injection attacks.
• Tested locally to confirm that crafted attachment URLs no longer break log file structure or allow misleading log entries.

I believe this small fix improves log integrity and security without affecting existing functionality. Please review the PR when convenient, and I am happy to make any requested changes.