Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
When sensitive information like passwords, tokens, or personal data is logged, it becomes accessible to anyone with access to the logs. Log files are often stored with less security than the data they contain.
Comment corriger cette vulnérabilité
Stratégies de prévention pour Information Exposure Through Logs basées sur 3 règles de détection Shoulder.
Never log passwords, tokens, or PII; log presence/absence instead
func authenticateUser(username, password string) error { - log.Printf("Auth: user=%s password=%s", username, password) + log.Printf("Auth attempt: user=%s", username) return nil }
Exclude sensitive fields from logged data using destructuring or redaction
app.post('/login', (req, res) => { - console.log('Login request:', req.body); + const { password, ...safeBody } = req.body; + logger.info('Login request:', safeBody); });
Redact sensitive fields before logging; log actions and identifiers, not credentials
import logging logger = logging.getLogger(__name__) def login(username, password): - logger.info(f"Login: user={username}, password={password}") + logger.info(f"Login attempt for user: {username}") authenticate(username, password)
Trouvez les vulnérabilités dans votre code
Utilisez Shoulder pour scanner votre code à la recherche de patterns Insertion of Sensitive Information into Log File. 3 règles.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=532 # Or scan entire project npx @shoulderdev/cli trust .
Règles de Détection (3)
Ce qu'il faut surveiller lors des revues de code
Ces patterns indiquent des vulnérabilités potentielles Insertion of Sensitive Information into Log File. Recherchez-les lors des revues de code et des audits de sécurité.
Scannez votre base de code pour Insertion of Sensitive Information into Log File
Shoulder CLI trouve les motifs vulnérables dans toute votre base de code.