Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
When sensitive information like passwords, tokens, or personal data is logged, it becomes accessible to anyone with access to the logs. Log files are often stored with less security than the data they contain.
この脆弱性の修正方法
3 件の Shoulder 検出ルールに基づく Information Exposure Through Logs の予防策。
Never log passwords, tokens, or PII; log presence/absence instead
func authenticateUser(username, password string) error { - log.Printf("Auth: user=%s password=%s", username, password) + log.Printf("Auth attempt: user=%s", username) return nil }
Exclude sensitive fields from logged data using destructuring or redaction
app.post('/login', (req, res) => { - console.log('Login request:', req.body); + const { password, ...safeBody } = req.body; + logger.info('Login request:', safeBody); });
Redact sensitive fields before logging; log actions and identifiers, not credentials
import logging logger = logging.getLogger(__name__) def login(username, password): - logger.info(f"Login: user={username}, password={password}") + logger.info(f"Login attempt for user: {username}") authenticate(username, password)
コードの脆弱性を見つける
Shoulderを使用してコードのInsertion of Sensitive Information into Log Fileパターンをスキャンしましょう。 3 ルール.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=532 # Or scan entire project npx @shoulderdev/cli trust .
検出ルール (3)
コードレビューで注目すべき点
これらのパターンはInsertion of Sensitive Information into Log Fileの潜在的な脆弱性を示しています。コードレビューとセキュリティ監査中に探してください。
コードベースをスキャン: Insertion of Sensitive Information into Log File
Shoulder CLI はコードベース全体から脆弱なパターンを見つけます。