Rule Definition
Writing unvalidated, unsanitized user input to log files can allow an attacker to forge log entries or inject malicious content into the logs. Applications typically use log files to store a history of events or transactions for later review, statistics gathering, or debugging. Depending on the nature of the application, the task of reviewing log files may be performed manually or sometimes automated with a tool that automatically gathers log data for important events or trending information. Interpretation of the log files may be hindered or misdirected if an attacker can supply data to the application that is subsequently logged verbatim.

Remediation
Use authorized sanitization methods.

Violation Code Sample

String val; // value given by an API request
try {
    int value = Integer.parseInt(value);
}
catch (NumberFormatException) {
    log.info("Failed to parse value = " + value);
}

Fixed Code Sample

String val; // value given by an API request
try {
    int value = Integer.parseInt(value);
}
catch (NumberFormatException) {
    String sanitizedValue = ... // Sanitize here the value
    log.info("Failed to parse value = " + sanitizedValue);
}

CWE-117: Improper Output Neutralization for Logs https://cwe.mitre.org/data/definitions/117.html Open Web Application Security Project (OWASP) https://www.owasp.org/index.php/A6_2004_Injection_Flaws