Improper Output Neutralization for Logs
The product does not neutralize or incorrectly neutralizes output that is written to logs.
Log injection attacks occur when user input is written to log files without proper sanitization. This can allow attackers to forge log entries, inject malicious content, or exploit log analysis tools.
如何修复此漏洞
基于 4 条 Shoulder 检测规则的 Log Injection 预防策略。
Strip newlines and control characters from user input before logging
package main import ( "log" "net/http" - ) - - func handler(w http.ResponseWriter, r *http.Request) { - username := r.URL.Query().Get("user") - // Vulnerable: user input logged directly - log.Printf("Login attempt for user: %s", username) + "strings" + ) + + func sanitizeLogInput(s string) string { + s = strings.ReplaceAll(s, "\n", "") + s = strings.ReplaceAll(s, "\r", "") + return s + } + + func handler(w http.ResponseWriter, r *http.Request) { + username := r.URL.Query().Get("user") + // Safe: newlines stripped before logging + log.Printf("Login attempt for user: %s", sanitizeLogInput(username)) }
Strip newline characters from user input before writing to log files
const express = require('express'); const winston = require('winston'); const app = express(); app.post('/login', (req, res) => { - const username = req.body.username; + const username = req.body.username.replace(/[\r\n]/g, ''); winston.info(`Login attempt: ${username}`); res.json({ status: 'ok' }); });
Sanitize user input by stripping CRLF characters before writing to logs
- app.post('/login', (req, res) => { - logger.info(`Login attempt from: ${req.body.username}`); + const sanitize = (str) => str.replace(/[\r\n]/g, '').substring(0, 200); + + app.post('/login', (req, res) => { + logger.info('Login attempt', { username: sanitize(req.body.username) }); });
Use structured logging with separate fields for user data instead of string interpolation
import logging from flask import request - @app.route('/login', methods=['POST']) - def login(): - username = request.form.get('username') - logging.info(f"Login attempt for user: {username}") + logger = logging.getLogger(__name__) + + @app.route('/login', methods=['POST']) + def login(): + username = request.form.get('username', '') + logger.info("Login attempt", extra={'username': username}) return "OK"
查找代码中的漏洞
使用Shoulder扫描代码中的Improper Output Neutralization for Logs模式。 4 规则.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=117 # Or scan entire project npx @shoulderdev/cli trust .
检测规则 (4)
代码审查中需要关注的内容
这些模式表明潜在的Improper Output Neutralization for Logs漏洞。在代码审查和安全审计中注意查找。
扫描你的代码库: Improper Output Neutralization for Logs
Shoulder CLI 在整个代码库中找到易受攻击的模式。