Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
When sensitive information like passwords, tokens, or personal data is logged, it becomes accessible to anyone with access to the logs. Log files are often stored with less security than the data they contain.
So behebst du diese Schwachstelle
Präventionsstrategien für Information Exposure Through Logs basierend auf 3 Shoulder-Erkennungsregeln.
Never log passwords, tokens, or PII; log presence/absence instead
func authenticateUser(username, password string) error { - log.Printf("Auth: user=%s password=%s", username, password) + log.Printf("Auth attempt: user=%s", username) return nil }
Exclude sensitive fields from logged data using destructuring or redaction
app.post('/login', (req, res) => { - console.log('Login request:', req.body); + const { password, ...safeBody } = req.body; + logger.info('Login request:', safeBody); });
Redact sensitive fields before logging; log actions and identifiers, not credentials
import logging logger = logging.getLogger(__name__) def login(username, password): - logger.info(f"Login: user={username}, password={password}") + logger.info(f"Login attempt for user: {username}") authenticate(username, password)
Finden Sie Schwachstellen in Ihrem Code
Verwenden Sie Shoulder, um Ihren Code nach Insertion of Sensitive Information into Log File-Mustern zu scannen. 3 Regeln.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=532 # Or scan entire project npx @shoulderdev/cli trust .
Erkennungsregeln (3)
Worauf bei Code-Reviews zu achten ist
Diese Muster weisen auf potenzielle Insertion of Sensitive Information into Log File-Schwachstellen hin. Achten Sie bei Code-Reviews und Sicherheitsaudits darauf.
Scanne deine Codebasis nach Insertion of Sensitive Information into Log File
Shoulder CLI findet anfällige Muster in deiner gesamten Codebasis.