# Insertion of Sensitive Information into Log File (CWE-532)

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

- Prevalence: Média 3 linguagens cobertas
- Impact: Alto 1 regras de severidade alta
- Prevention: Documentada 3 exemplos de correção

**OWASP:** Security Logging and Monitoring Failures (A09:2021-Security Logging and Monitoring Failures) - #9

## Description

When sensitive information like passwords, tokens, or personal data is logged, it becomes accessible to anyone with access to the logs. Log files are often stored with less security than the data they contain.

## Prevention

Estratégias de prevenção para Information Exposure Through Logs baseadas em 3 regras de detecção do Shoulder.

### Go

Never log passwords, tokens, or PII; log presence/absence instead

### JavaScript

Exclude sensitive fields from logged data using destructuring or redaction

### Python

Redact sensitive fields before logging; log actions and identifiers, not credentials

## Warning Signs

- [HIGH] logging of sensitive data like passwords, API keys, tokens, credit
cards, or authentication credenti
- [MEDIUM] when user-provided sensitive data (passwords, tokens, API keys, secrets, etc

## Consequences

- Ler dados da aplicação
- Obter privilégios

## Mitigations

- Nunca registre em log informações sensíveis como senhas ou tokens
- Implemente classificação e filtragem dos dados de log
- Mascare ou redija dados sensíveis antes de registrar em log

## Detection

- Total rules: 3
- Languages: go, javascript, typescript, python

## Rules by Language

### Go (1 rules)

- **Logging Sensitive Data** [MEDIUM]: Passwords, tokens, or PII logged via log.Printf or similar functions.
  - Remediation: Never log sensitive values. Log presence/absence instead of actual values.

```go
// Log only that API key is configured, not the value
if apiKey != "" {
    log.Println("API key configured")
}
```

Learn more: https://shoulder.dev/learn/go/cwe-532/sensitive-data-logging

### Javascript (1 rules)

- **Sensitive Data Exposure in Logs** [MEDIUM]: Detects when user-provided sensitive data (passwords, tokens, API keys, secrets, etc.)
flows directly into logging functions without proper redaction or masking.

This rule uses taint flow analysis to detect ACTUAL sensitive data being logged,
not just variables with sensitive names. Only triggers when:
1. Data originates from user input (req.body, req.headers, etc.)
2. Contains sensitive field names (password, token, secret, etc.)
3. Flows into logging functions without sanitization

Sensitive 
  - Remediation: Exclude sensitive fields from logged data:

```javascript
const { password, ...safeBody } = req.body;
console.log('Request body:', safeBody);

function redactToken(token) {
  return token ? token.substring(0, 4) + '***' : '';
}
logger.info('Token:', redactToken(authToken));
```

Learn more: https://shoulder.dev/learn/javascript/cwe-532/sensitive-data-logging

### Typescript (1 rules)

- **Sensitive Data Exposure in Logs** [MEDIUM]: Detects when user-provided sensitive data (passwords, tokens, API keys, secrets, etc.)
flows directly into logging functions without proper redaction or masking.

This rule uses taint flow analysis to detect ACTUAL sensitive data being logged,
not just variables with sensitive names. Only triggers when:
1. Data originates from user input (req.body, req.headers, etc.)
2. Contains sensitive field names (password, token, secret, etc.)
3. Flows into logging functions without sanitization

Sensitive 
  - Remediation: Exclude sensitive fields from logged data:

```javascript
const { password, ...safeBody } = req.body;
console.log('Request body:', safeBody);

function redactToken(token) {
  return token ? token.substring(0, 4) + '***' : '';
}
logger.info('Token:', redactToken(authToken));
```

Learn more: https://shoulder.dev/learn/javascript/cwe-532/sensitive-data-logging

### Python (1 rules)

- **Sensitive Data in Logging** [HIGH]: Detects logging of sensitive data like passwords, API keys, tokens, credit
cards, or authentication credentials. Logged sensitive data can be exposed
through log files, monitoring systems, or error tracking services.
  - Remediation: Redact sensitive fields before logging; log actions and usernames, not credentials.

```python
import logging

logger = logging.getLogger(__name__)

SENSITIVE = {'password', 'token', 'api_key', 'secret'}

def sanitize(data):
    return {k: '***' if k in SENSITIVE else v for k, v in data.items()}

def login(username, password):
    logger.info(f"Login attempt for: {username}")  # Log username, not password
    authenticate(username, password)
```

Learn more: https://shoulder.dev/learn/python/cwe-532/sensitive-data-logging