Potential fix for code scanning alert no. 1: Log entries created from user input

[grokify]

Potential fix for https://github.com/agentplexus/omnivoice/security/code-scanning/1

In general, to fix this kind of issue you should sanitize or encode any user-provided value before writing it to logs. For plain-text logs, the primary concern is stripping line breaks (\n, \r) so an attacker cannot inject extra fake log lines or otherwise confuse log viewers and parsers.

For this specific code, the best minimal fix is to create sanitized variants of the user-controlled values from (and, defensively, also to and callSID) just before logging, by removing \n and \r characters using strings.ReplaceAll. Then use the sanitized variables in the log.Printf call. This keeps the existing behavior and log format, but ensures that no embedded line breaks from user input reach the logs. To implement this, we need to import the standard library package strings at the top of examples/twilio-agent/main.go and adjust the handleInboundCall function so that it computes safeFrom, safeTo, and safeCallSID for logging, while leaving the original variables intact for use in building the TwiML/URL if desired.

Concretely:

• In examples/twilio-agent/main.go, add strings to the import block.
• In handleInboundCall, after reading from, to, and callSID, create sanitized versions with strings.ReplaceAll to strip \n and \r.
• Replace the log.Printf call on line 79 to use the sanitized variables.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.