Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
When sensitive information like passwords, tokens, or personal data is logged, it becomes accessible to anyone with access to the logs. Log files are often stored with less security than the data they contain.
이 취약점을 수정하는 방법
3개의 Shoulder 탐지 규칙을 기반으로 한 Information Exposure Through Logs 예방 전략.
Never log passwords, tokens, or PII; log presence/absence instead
func authenticateUser(username, password string) error { - log.Printf("Auth: user=%s password=%s", username, password) + log.Printf("Auth attempt: user=%s", username) return nil }
Exclude sensitive fields from logged data using destructuring or redaction
app.post('/login', (req, res) => { - console.log('Login request:', req.body); + const { password, ...safeBody } = req.body; + logger.info('Login request:', safeBody); });
Redact sensitive fields before logging; log actions and identifiers, not credentials
import logging logger = logging.getLogger(__name__) def login(username, password): - logger.info(f"Login: user={username}, password={password}") + logger.info(f"Login attempt for user: {username}") authenticate(username, password)
코드에서 취약점 찾기
Shoulder를 사용하여 코드에서 Insertion of Sensitive Information into Log File 패턴을 스캔하세요. 3 규칙.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=532 # Or scan entire project npx @shoulderdev/cli trust .
탐지 규칙 (3)
코드 리뷰에서 주의할 점
이 패턴은 잠재적인 Insertion of Sensitive Information into Log File 취약점을 나타냅니다. 코드 리뷰와 보안 감사 중에 찾아보세요.
코드베이스를 스캔하세요: Insertion of Sensitive Information into Log File
Shoulder CLI는 전체 코드베이스에서 취약한 패턴을 찾아냅니다.