# Improper Output Neutralization for Logs (CWE-117)

The product does not neutralize or incorrectly neutralizes output that is written to logs.

**Stack:** Python

- Prevalence: Mittel 3 Sprachen abgedeckt
- Impact: Mittel Review empfohlen
- Prevention: Dokumentiert 4 Fix-Beispiele

**OWASP:** Injection (A03:2021-Injection) - #3

## Description

Log injection attacks occur when user input is written to log files without proper sanitization. This can allow attackers to forge log entries, inject malicious content, or exploit log analysis tools.

## Prevention

Präventionsstrategien für Log Injection basierend auf 1 Shoulder-Erkennungsregeln.

### Python

Use structured logging with separate fields for user data instead of string interpolation

## Warning Signs

- [MEDIUM] user input flowing directly into log messages without sanitization

## Consequences

- Anwendungsdaten ändern
- Aktivitäten verbergen
- Nicht autorisierten Code ausführen

## Mitigations

- Validiere und bereinige alle Eingaben, bevor sie in Logs geschrieben werden
- Verwende strukturierte Log-Formate, die Daten von der Log-Syntax trennen
- Encodiere Sonderzeichen, wenn benutzergesteuerte Daten in Logs geschrieben werden

## Detection

- Total rules: 4
- Languages: go, javascript, typescript, python

## Rules by Language

### Python (1 rules)

- **Log Injection / Log Forging** [MEDIUM]: Detects user input flowing directly into log messages without sanitization.
  - Remediation: Use structured logging with separate fields for user data.

```python
logging.info("Login attempt", extra={'username': username})
```

Learn more: https://shoulder.dev/learn/python/cwe-117/log-injection