BETA Shoulder ist in der Beta — Befunde können manchmal falsch sein. Dein Feedback bestimmt, was wir als Nächstes beheben. Feedback teilen
📝

Improper Output Neutralization for Logs

🛡️ 4 Regeln erkennen dies

Improper Output Neutralization for Logs

The product does not neutralize or incorrectly neutralizes output that is written to logs.

Log injection attacks occur when user input is written to log files without proper sanitization. This can allow attackers to forge log entries, inject malicious content, or exploit log analysis tools.

Verbreitung
Mittel
3 Sprachen abgedeckt
Auswirkung
Mittel
Review empfohlen
Prävention
Dokumentiert
4 Fix-Beispiele
2 Prävention
2 Prävention

So behebst du diese Schwachstelle

Präventionsstrategien für Log Injection basierend auf 4 Shoulder-Erkennungsregeln.

Log Injection / Log Forging MEDIUM

Strip newlines and control characters from user input before logging

+13 -6 go
  package main
  
  import (
      "log"
      "net/http"
- )
- 
- func handler(w http.ResponseWriter, r *http.Request) {
-     username := r.URL.Query().Get("user")
-     // Vulnerable: user input logged directly
-     log.Printf("Login attempt for user: %s", username)
+     "strings"
+ )
+ 
+ func sanitizeLogInput(s string) string {
+     s = strings.ReplaceAll(s, "\n", "")
+     s = strings.ReplaceAll(s, "\r", "")
+     return s
+ }
+ 
+ func handler(w http.ResponseWriter, r *http.Request) {
+     username := r.URL.Query().Get("user")
+     // Safe: newlines stripped before logging
+     log.Printf("Login attempt for user: %s", sanitizeLogInput(username))
  }
  
Log Injection LOW

Strip newline characters from user input before writing to log files

+1 -1 javascript
  const express = require('express');
  const winston = require('winston');
  const app = express();
  
  app.post('/login', (req, res) => {
-   const username = req.body.username;
+   const username = req.body.username.replace(/[\r\n]/g, '');
    winston.info(`Login attempt: ${username}`);
    res.json({ status: 'ok' });
  });
  
Log Injection MEDIUM

Sanitize user input by stripping CRLF characters before writing to logs

+4 -2 javascript
- app.post('/login', (req, res) => {
-   logger.info(`Login attempt from: ${req.body.username}`);
+ const sanitize = (str) => str.replace(/[\r\n]/g, '').substring(0, 200);
+ 
+ app.post('/login', (req, res) => {
+   logger.info('Login attempt', { username: sanitize(req.body.username) });
  });
  
Log Injection / Log Forging MEDIUM

Use structured logging with separate fields for user data instead of string interpolation

+6 -4 python
  import logging
  from flask import request
  
- @app.route('/login', methods=['POST'])
- def login():
-     username = request.form.get('username')
-     logging.info(f"Login attempt for user: {username}")
+ logger = logging.getLogger(__name__)
+ 
+ @app.route('/login', methods=['POST'])
+ def login():
+     username = request.form.get('username', '')
+     logger.info("Login attempt", extra={'username': username})
      return "OK"
  
3 Erkennung
3 Erkennung

Finden Sie Schwachstellen in Ihrem Code

Verwenden Sie Shoulder, um Ihren Code nach Improper Output Neutralization for Logs-Mustern zu scannen. 4 Regeln.

Terminal
# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=117

# Or scan entire project
npx @shoulderdev/cli trust .
4 Warnzeichen
4 Warnzeichen

Worauf bei Code-Reviews zu achten ist

Diese Muster weisen auf potenzielle Improper Output Neutralization for Logs-Schwachstellen hin. Achten Sie bei Code-Reviews und Sicherheitsaudits darauf.

🟡
unsanitized user input flowing into log statements, enabling log forging attacks go-log-injection
🟡
user input flowing directly into log messages without sanitization python-log-injection
🔵
user input flowing to persistent log files without sanitization javascript-log-injection
🔍

Scanne deine Codebasis nach Improper Output Neutralization for Logs

Shoulder CLI findet anfällige Muster in deiner gesamten Codebasis.