Skip to content

Commit 7674e07

Browse files
committed
Add first sentence as a rule to follow
Signed-off-by: emcdtho <[email protected]>
1 parent 721ff5f commit 7674e07

File tree

1 file changed

+1
-1
lines changed
  • docs/Secure-Coding-Guide-for-Python/CWE-707/CWE-117

1 file changed

+1
-1
lines changed

docs/Secure-Coding-Guide-for-Python/CWE-707/CWE-117/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# CWE-117: Improper Output Neutralization for Logs
22

3-
Log injection occurs when untrusted data is written to application logs without proper neutralization, allowing attackers to forge log entries or inject malicious content. Attackers can inject fake log records or hide real ones by inserting newline sequences (`\r` or `\n`), misleading auditors and incident-response teams. This vulnerability can also enable injection of XSS attacks when logs are viewed in vulnerable web applications.
3+
Ensure all untrusted data is properly neutralized or sanitized before writing to application logs. Log injection occurs when untrusted data is written to application logs without proper neutralization, allowing attackers to forge log entries or inject malicious content. Attackers can inject fake log records or hide real ones by inserting newline sequences (`\r` or `\n`), misleading auditors and incident-response teams. This vulnerability can also enable injection of XSS attacks when logs are viewed in vulnerable web applications.
44

55
Attackers can exploit this weakness (see [*Attacks on Logs*](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html#attacks-on-logs) [[OWASP 2025]](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html#attacks-on-logs)) by submitting strings containing CRLF sequences that create fake log entries.
66

0 commit comments

Comments
 (0)