rpc,wallet: prevent user input injecting fake log lines #35833

Problem: Restricted RPC users and callers of createwallet or restorewallet can inject newlines through rejected methods or wallet names, and global log escaping preserves them, making forged lines look like node messages. Wallet names also serve as filesystem paths and appear in UIs, where invisible controls are undesirable. [Comments in #35768](/bitcoin-bitcoin/35768/#issuecomment-5050755259) indicated that we can still reject invalid new names while keeping existing names loadable.

Fix: Sanitize rejected method names on both whitelist paths and reject control characters in names supplied through createwallet, GUI wallet creation, or restorewallet. Authorization still uses the original method string, ordinary wallet loading remains unchanged, and migration rollback restores an existing name with a warning.

<details> <summary>Manual reproducer</summary>

DATADIR="$(mktemp -d /tmp/bitcoin-log-injection.XXXXXX)"
M="$(date -u +%Y-%m-%dT%H:%M:%SZ) ERROR: ConnectTip: ConnectBlock 0000000000000000deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef failed, bad-txns-inputs-missingorspent"
cmake -B build >/dev/null 2>&1 && cmake --build build -j >/dev/null 2>&1
build/bin/bitcoind -regtest -daemonwait -datadir="$DATADIR" -rpcwhitelist=__cookie__:getblock,stop >/dev/null 2>&1
build/bin/bitcoin-cli -regtest -datadir="$DATADIR" $'getblock\n'"$M" >/dev/null 2>&1; killall bitcoind >/dev/null
echo; grep -E 'ConnectTip|not allowed' "$DATADIR/regtest/debug.log"

Before

2026-07-28T23:18:57Z [warning] RPC User __cookie__ not allowed to call method getblock
2026-07-28T23:18:55Z ERROR: ConnectTip: ConnectBlock 0000000000000000deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef failed, bad-txns-inputs-missingorspent

After

2026-07-28T23:19:45Z [warning] RPC User __cookie__ not allowed to call method getblock2026-07-28T23:19:41Z ERROR: ConnectTip: ConnectBlock 0000000000000000deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef failed, bad-txns-inputs-missingorspent

</details>

<!--e57a25ab6845829454e8d69fc972939a-->

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

<!--006a51241073e994b41acfe9ec718e94-->

Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/35833.

<!--021abf342d371248e50ceaed478a90ca-->

Reviews

See the guideline and AI policy for information on the review process. A summary of reviews will appear here.

<!--174a7506f384e20aa4161008e828411d-->

Conflicts

Reviewers, this pull request conflicts with the following ones:

• #35768 (wallet: Reject whitespace-only wallet names by vicjuma)

If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

<!--5faf32d7da4f0f540f40219e4f7537a3-->

Just posting mostly as a curiosity to see if you looked at whether the logging interface is vulnerable to format string attacks. I don't think it is, but would be interested in knowing if so. Though I'm not aware of anywhere in the p2p interface that can arbitrarily log blobs.

I wonder if non-trailing b"\n" can be wholesale rejected by the log framework, unless they are opt-in for the IIRC single log line that "needs" them?

If someone does a followup that addresses that for the whole log framework, please ping me. Here I meant to cover the two exceptional cases I found of user-provided data that escapes sanitization.