Rule Definition
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

Remediation
Never log (received) user data without filtering it, and in particular, secrets. Consider seriously the sensitivity of the information written into log files.

Violation Code Sample

# direct logging of user credentials
logging.info("User credentials: {}".format(password))  # VIOLATION

# the origin of the logged content is inspected to some extent
x = get_password()
logging.info("{}".format(x))                           # VIOLATION

Fixed Code Sample

# Log the state without sensible data
logging.info("Received user credentials")     // FIXED, no sentitiva date exposed

CWE-359: Exposure of Private Personal Information to an Unauthorized Actor https://cwe.mitre.org/data/definitions/359.html CWE-532: Insertion of Sensitive Information into Log File https://cwe.mitre.org/data/definitions/532.html OWASP Cheat Sheet Series - Logging Cheat Sheet https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html