Skip to content

Commit 65dd460

Browse files
BartKaras1128BartKaras1128
authored
CWE-117, added html tables back.
Signed-off-by: Bartlomiej Karas <[email protected]>
1 parent 887a733 commit 65dd460

File tree

1 file changed

+99
-18
lines changed
  • docs/Secure-Coding-Guide-for-Python/CWE-707/CWE-117

1 file changed

+99
-18
lines changed

‎docs/Secure-Coding-Guide-for-Python/CWE-707/CWE-117/README.md‎

Lines changed: 99 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -94,27 +94,108 @@ WARNING:root:Rejected login attempt: invalid username="guest'\nWARNING:root:User
9494

9595
## Automated Detection
9696

97-
|Tool|Version|Checker|Description|
98-
|:---|:---|:---|:---|
99-
|Bandit|1.7.4 on Python 3.10.4|B105<br>B106<br>B107|[B105: hardcoded_password_string — Bandit documentation](https://bandit.readthedocs.io/en/latest/plugins/b105_hardcoded_password_string.html)<br>[B106: hardcoded_password_funcarg — Bandit documentation](https://bandit.readthedocs.io/en/latest/plugins/b106_hardcoded_password_funcarg.html)<br>[B107: hardcoded_password_default — Bandit documentation](https://bandit.readthedocs.io/en/latest/plugins/b107_hardcoded_password_default.html)|
100-
|sonarsource||RSPEC-2068<br>RSPEC-6437|[Python static code analysis: Hard-coded credentials are security-sensitive (sonarsource.com)](https://rules.sonarsource.com/python/RSPEC-2068)<br>[Credentials should not be hard-coded (sonarsource.com)](https://rules.sonarsource.com/python/type/Vulnerability/RSPEC-6437/)|
101-
|codeQL|||[Hard-coded credentials — CodeQL query help documentation (github.com)](https://codeql.github.com/codeql-query-help/python/py-hardcoded-credentials/)|
97+
<table>
98+
<thead>
99+
<tr>
100+
<th>Tool</th>
101+
<th>Version</th>
102+
<th>Check</th>
103+
<th>Description</th>
104+
</tr>
105+
</thead>
106+
<tbody>
107+
<tr>
108+
<td>Bandit</td>
109+
<td>1.7.5</td>
110+
<td>Not Available</td>
111+
<td></td>
112+
</tr>
113+
<tr>
114+
<td>CodeQL</td>
115+
<td>Latest</td>
116+
<td><a href="https://codeql.github.com/codeql-query-help/python/py-log-injection/">py-log-injection</a></td>
117+
<td></td>
118+
</tr>
119+
<tr>
120+
<td>Veracode</td>
121+
<td>Latest</td>
122+
<td>CWE 117</td>
123+
<td><a href="https://community.veracode.com/s/article/How-to-Fix-CWE-117-Improper-Output-Neutralization-for-Logs">How to Fix CWE-117</a></td>
124+
</tr>
125+
</tbody>
126+
</table>
102127

103128
## Related Guidelines
104129

105-
|||
106-
|:---|:---|
107-
|[MITRE CWE](http://cwe.mitre.org/)|Pillar: [CWE-693: Protection Mechanism Failure (4.12) (mitre.org)](https://cwe.mitre.org/data/definitions/693.html)|
108-
|[MITRE CWE](http://cwe.mitre.org/)|Base: [CWE-798: Use of hardcoded credentials](https://cwe.mitre.org/data/definitions/798.html)|
109-
|[MITRE CWE](http://cwe.mitre.org/)|Variant: [CWE-259: Use of hardcoded password](https://cwe.mitre.org/data/definitions/259.html)|
110-
|[MITRE CWE](http://cwe.mitre.org/)|Variant: [CWE-321: Use of hardcode cryptographic key](https://cwe.mitre.org/data/definitions/321.html)|
111-
|[SEI CERT Oracle Codign Standard for Java](https://wiki.sei.cmu.edu/confluence/display/java/SEI+CERT+Oracle+Coding+Standard+for+Java)|[MSC03-J: Never hardcode sensitive information](https://wiki.sei.cmu.edu/confluence/display/java/MSC03-J.+Never+hard+code+sensitive+information)|
130+
<table>
131+
<tr>
132+
<td><a href="http://cwe.mitre.org/">MITRE CWE</a></td>
133+
<td>Pillar: <a href="https://cwe.mitre.org/data/definitions/707.html"> CWE-707: Improper Neutralization</a></td>
134+
</tr>
135+
<tr>
136+
<td><a href="http://cwe.mitre.org/">MITRE CWE</a></td>
137+
<td>Base: <a href="https://cwe.mitre.org/data/definitions/117.html">CWE-117: Improper Output Neutralization for Log </a></td>
138+
</tr>
139+
<tr>
140+
<td><a href="http://cwe.mitre.org/">MITRE CWE</a></td>
141+
<td>Base: <a href="https://cwe.mitre.org/data/definitions/93.html">CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') </a></td>
142+
</tr>
143+
<tr>
144+
<td><a href="http://cwe.mitre.org/">MITRE CWE</a></td>
145+
<td>Variant: <a href="https://cwe.mitre.org/data/definitions/113.html">CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') </a></td>
146+
</tr>
147+
<tr>
148+
<td><a href="http://capec.mitre.org/">MITRE CAPEC</a></td>
149+
<td>Detailed: <a href="https://capec.mitre.org/data/definitions/93.html">CAPEC-93: Log Injection-Tampering-Forging </a></td>
150+
</tr>
151+
<tr>
152+
<td><a href="https://owasp.org/Top10/">OWASP Top 10</a></td>
153+
<td><a href="https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/">A09:2021 – Security Logging and Monitoring Failures </a></td>
154+
</tr>
155+
<tr>
156+
<td><a href="https://owasp.org/">OWASP ASVS 4.0</a></td>
157+
<td><a href="https://owasp.org/www-project-application-security-verification-standard/">OWASP Application Security Verification Standard (ASVS) </a>. See "V16 Security Logging and Error Handling".
158+
</td>
159+
<tr>
160+
<td><a href="https://cheatsheetseries.owasp.org/index.html">OWASP Cheat Sheet Series</a></td>
161+
<td><a href="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html">OWASP Logging Cheat Sheet</a></td>
162+
</tr>
163+
</tr>
164+
<tr>
165+
<td>ISO/IEC TR 24772:2013</td>
166+
<td><a href="https://www.iso.org/standard/61457.html">ISO/IEC TR 24772:2013 Information technology — Programming languages — Guidance to avoiding vulnerabilities in programming languages through language selection and use </a></td>
167+
</tr>
168+
<tr>
169+
<td>NIST SP 800-92</td>
170+
<td><a href="https://csrc.nist.gov/pubs/sp/800/92/final">NIST SP 800-92 Guide to Computer Security Log Management </a></td>
171+
</tr>
172+
</table>
112173

113174
## Bibliography
114175

115-
|||
116-
|:---|:---|
117-
| [US Congress 1996] | Health Insurance Portability and Accountability Act (HIPAA) [online].Available from: [https://aspe.hhs.gov/reports/health-insurance-portability-accountability-act-1996](https://aspe.hhs.gov/reports/health-insurance-portability-accountability-act-1996) [accessed 27 February 2025]|
118-
| [European Parliament 2016] | General Data Protection Regulation (GDPR) [online]. Available from: [https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.150](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.150) [accessed 27 February 2025]|
119-
| [CPPA 2025] |DIVISION 3. OBLIGATIONS [1427 - 3273.16] [online]. Available from: [https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.150](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.150) [accessed 27 February 2025]|
120-
| [OSSF 2025] | CWE-532: Insertion of Sensitive Information into Log File [online]. Available from: [https://best.openssf.org/Secure-Coding-Guide-for-Python/CWE-664/CWE-532/](https://best.openssf.org/Secure-Coding-Guide-for-Python/CWE-664/CWE-532/) [accessed 27 February 2025]|
176+
<table>
177+
<tr>
178+
<td>[CWE-117]</a></td>
179+
<td>CWE-117: Improper Output Neutralization for Log [online]. Available from <a href="https://cwe.mitre.org/data/definitions/117.html">https://cwe.mitre.org/data/definitions/117.html</a>, [Accessed 24 September 2025]</td>
180+
</tr>
181+
<tr>
182+
<td>[CWE-93]</a></td>
183+
<td>CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') [online]. Available from: <a href="https://cwe.mitre.org/data/definitions/93.html">https://cwe.mitre.org/data/definitions/93.html</a>, [Accessed 24 September 2025]</td>
184+
</tr>
185+
<tr>
186+
<td>[CWE-113]</a></td>
187+
<td>CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')<a href="https://cwe.mitre.org/data/definitions/113.html">https://cwe.mitre.org/data/definitions/113.html</a>, [Accessed 24 September 2025]</td>
188+
</tr>
189+
<tr>
190+
<td>[CAPEC-93]</td>
191+
<td>CAPEC-93: Log Injection-Tampering-Forging [online]. Available from: <a href="https://capec.mitre.org/data/definitions/93.html">https://capec.mitre.org/data/definitions/93.html</a>, [Accessed 24 September 2025]</td>
192+
</tr>
193+
<tr>
194+
<td>[OWASP A09:2021]</td>
195+
<td>A09:2021 – Security Logging and Monitoring Failures [online]. Available from:<a href="https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/">https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/</a>, [Accessed 24 September 2025]</td>
196+
</tr>
197+
<tr>
198+
<td>[OWASP 2025]</td>
199+
<td>OWASP Cheat Sheet Series: Logging Cheat Sheet [online]. Available from: <a href="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html">https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html</a> (see “Event collection” and “Attacks on Logs”). [Accessed 24 September 2025]</td>
200+
</tr>
201+
</table>

0 commit comments

Comments
 (0)