# Insertion of Sensitive Information into Log File (CWE-532)

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

**Stack:** Python

- Prevalence: मध्यम 3 भाषाएँ कवर की गईं
- Impact: उच्च 1 उच्च गंभीरता वाले नियम
- Prevention: प्रलेखित 3 फिक्स उदाहरण

**OWASP:** Security Logging and Monitoring Failures (A09:2021-Security Logging and Monitoring Failures) - #9

## Description

When sensitive information like passwords, tokens, or personal data is logged, it becomes accessible to anyone with access to the logs. Log files are often stored with less security than the data they contain.

## Prevention

1 Shoulder डिटेक्शन नियमों पर आधारित Information Exposure Through Logs के लिए रोकथाम रणनीतियाँ।

### Python

Redact sensitive fields before logging; log actions and identifiers, not credentials

## Warning Signs

- [HIGH] logging of sensitive data like passwords, API keys, tokens, credit
cards, or authentication credenti

## Consequences

- एप्लिकेशन डेटा पढ़ना
- विशेषाधिकार प्राप्त करना

## Mitigations

- पासवर्ड या टोकन जैसी संवेदनशील जानकारी कभी लॉग न करें
- लॉग डेटा वर्गीकरण और फ़िल्टरिंग लागू करें
- लॉग करने से पहले संवेदनशील डेटा को मास्क या रिडैक्ट करें

## Detection

- Total rules: 3
- Languages: go, javascript, typescript, python

## Rules by Language

### Python (1 rules)

- **Sensitive Data in Logging** [HIGH]: Detects logging of sensitive data like passwords, API keys, tokens, credit
cards, or authentication credentials. Logged sensitive data can be exposed
through log files, monitoring systems, or error tracking services.
  - Remediation: Redact sensitive fields before logging; log actions and usernames, not credentials.

```python
import logging

logger = logging.getLogger(__name__)

SENSITIVE = {'password', 'token', 'api_key', 'secret'}

def sanitize(data):
    return {k: '***' if k in SENSITIVE else v for k, v in data.items()}

def login(username, password):
    logger.info(f"Login attempt for: {username}")  # Log username, not password
    authenticate(username, password)
```

Learn more: https://shoulder.dev/learn/python/cwe-532/sensitive-data-logging