Log Injection

Description

Detects user input flowing to persistent log files without sanitization.

What Shoulder detects

User input logged without sanitization. Attackers can inject newline characters to forge log entries.

How to fix

Sanitize user input by removing newline characters before logging.

```javascript
const safe = userInput.replace(/[\r\n]/g, '');
logger.info(safe);
```

Learn more: https://shoulder.dev/learn/javascript/cwe-117/log-injection

Applies to

Languages

🟨 JavaScript

Frameworks

nodejs express fastify koa hapi

References

Documentation ↗ Learn about CWE-117

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=javascript-log-injection .