Log Injection / Log Forging

Description

Detects unsanitized user input flowing into log statements, enabling log forging attacks.

What Shoulder detects

Untrusted input from {source} reaches log statement at {sink}.
This allows an attacker to forge log entries or inject malicious content.

How to fix

Remove newlines and control characters from user input before logging.

```go
sanitized := strings.ReplaceAll(userInput, "\n", "")
sanitized = strings.ReplaceAll(sanitized, "\r", "")
log.Printf("User action: %s", sanitized)
```

Learn more: https://shoulder.dev/learn/go/cwe-117/log-injection

Applies to

Languages

🐹 Go

Frameworks

stdlib gin echo fiber chi gorilla

References

Documentation ↗ OWASP ↗ Learn about CWE-117

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=go-log-injection .