Redact PII (paths, URIs, GUIDs, component names) from LSP telemetry#340
Draft
anderson-joyle wants to merge 2 commits into
Draft
Redact PII (paths, URIs, GUIDs, component names) from LSP telemetry#340anderson-joyle wants to merge 2 commits into
anderson-joyle wants to merge 2 commits into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR reduces exposure of end-user identifiable information (EUII/PII) in App Insights telemetry emitted by the PowerPlatformLS language server by routing sensitive log content through ILspLogger.LogSensitiveInformation (or by redacting GUIDs inline) while keeping telemetry-visible messages path/URI/name-free.
Changes:
- Reworked several LSP/server log call sites to emit safe telemetry messages while preserving sensitive detail for local Debug/test logging via
LogSensitiveInformation. - Redacted GUIDs from HTTP request
PathAndQueryinLoggingHttpHandlerto avoid leaking environment/bot identifiers in telemetry. - Updated/added unit tests to reflect the new logging/redaction behavior.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| src/LanguageServers/PowerPlatformLS/UnitTests/PowerPlatformLS.UnitTests/Impl.PullAgent/LoggingHttpHandlerTests.cs | Adds coverage ensuring GUIDs are redacted from logged HTTP request paths. |
| src/LanguageServers/PowerPlatformLS/UnitTests/PowerPlatformLS.UnitTests/Impl.Core/ChangeMethodTests.cs | Updates expectations for watched-file logging now that sensitive details flow via LogSensitiveInformation. |
| src/LanguageServers/PowerPlatformLS/Impl.PullAgent/LspExceptionHandler.cs | Prevents filesystem paths in FileNotFound/DirectoryNotFound exception messages from entering telemetry while returning full messages to the client. |
| src/LanguageServers/PowerPlatformLS/Impl.PullAgent/LoggingHttpHandler.cs | Introduces GUID redaction in logged request paths/queries using a compiled regex replacement. |
| src/LanguageServers/PowerPlatformLS/Impl.Core/LSP/Uris/LspUriFactory.cs | Ensures unsupported-scheme logs only include scheme in telemetry, keeping full samples local-only. |
| src/LanguageServers/PowerPlatformLS/Impl.Core/LSP/LanguageServer.cs | Removes raw URI/file-path logging from telemetry when language resolution fails, preserving detail locally. |
| src/LanguageServers/PowerPlatformLS/Impl.Core/LSP/Handlers/DidChangeWatchedFilesHandler.cs | Routes agent/component file-name-bearing watched-file logs through LogSensitiveInformation; makes the Warning message telemetry-safe. |
| src/LanguageServers/PowerPlatformLS/Impl.Core/DependencyInjection/HostApplicationBuilderExtensions.cs | Removes named-pipe/unix-socket path details from IPC startup logs. |
Comment on lines
+73
to
76
| // The full message (with file name) is routed through LogSensitiveInformation, | ||
| // which surfaces at Info level in Debug/test builds; the Warning is now file-name-free. | ||
| Assert.Single(logs.Info.Where(x => x == $"Can't process 'Changed' event for '{entry.filepath.Split('/')[^1]}': The file does not exist.")); | ||
| } |
Route language-server log call sites that leaked full file URIs/paths,
environment/bot GUIDs, and agent/component file names into telemetry through
the existing LogSensitiveInformation mechanism (or in-place redaction where
that API isn't available). Geo information is unaffected (it derives from
App Insights IP geolocation, not log messages).
- LanguageServer: "Failed to get language" now logs a URI-free Error plus the
full URI via LogSensitiveInformation (debug-only).
- LspUriFactory: unsupported-scheme sample redacted to scheme-only in telemetry.
- LspExceptionHandler: File/DirectoryNotFound log a path-free Error; full
message still returned to the client and surfaced locally.
- DidChangeWatchedFilesHandler: file-name log lines redacted (Info lines via
LogSensitiveInformation; the "file does not exist" warning drops the name,
preserved in debug).
- LoggingHttpHandler: GUIDs in request paths replaced with {id}.
- HostApplicationBuilderExtensions: IPC startup logs transport kind only.
Updated ChangeMethodTests (per-file message now surfaces at Info) and added a
GUID-redaction test for LoggingHttpHandler. Full unit suite: 873 passing.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f6d50381-bfe9-4a08-9a2d-d650cd7f5b42
anderson-joyle
force-pushed
the
andersonf/pii-fixes
branch
from
July 13, 2026 15:11
88bdd82 to
9e7e524
Compare
Comment on lines
+73
to
+75
| // The full message (with file name) is routed through LogSensitiveInformation, | ||
| // which surfaces at Info level in Debug/test builds; the Warning is now file-name-free. | ||
| Assert.Single(logs.Info.Where(x => x == $"Can't process 'Changed' event for '{entry.filepath.Split('/')[^1]}': The file does not exist.")); |
Contributor
Author
|
@copilot resolve the merge conflicts in this pull request |
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Redacts personal data (EUII) that C# language-server log call sites were emitting into telemetry (App Insights). This originated from analysis of a support telemetry export where full file paths (containing a user name and org-unit), agent/component names, and environment/bot GUIDs were visible in the
tracestable.The fix routes the leaking call sites through the existing
LogSensitiveInformationmechanism (or does in-place redaction where that API isn't available). Geo information is intentionally left untouched — it is derived by App Insights from the request IP, not from log message content.Changes
LanguageServer.csLogError(URI-free) +LogSensitiveInformation(full)LspExceptionHandler.csFileNotFound/DirectoryNotFoundmessagesLogError+LogSensitiveInformation(full); full message is still returned to the clientDidChangeWatchedFilesHandler.csLogSensitiveInformation; the "file does not exist" warning drops the name (retained in Debug)LspUriFactory.csLogSensitiveInformation(full, scheme-only safe message)LoggingHttpHandler.cs{id}HostApplicationBuilderExtensions.csBehavior notes
LogSensitiveInformation.FileNotFound/DirectoryNotFoundtelemetry message becomes generic ("File not found." / "Directory not found."). The full, path-bearing message is unchanged in the client response and in Debug.Tests
ChangeMethodTests(the per-file "file does not exist" message now surfaces at Info viaLogSensitiveInformationin Debug/test builds).GetPathAndQuery_Redacts_Guids_In_PathtoLoggingHttpHandlerTests.Out of scope (possible follow-ups)
GetCloudCacheFileHandler.csschema-name logs (a separate PII class).JsonRpcStream.cs{ex}last-resort diagnostic dumps.LspExceptionHandler(InvalidOperation / Http / etc.).