AWS logo
Amazon QDetector Library

Log Injection High

Unneutralized or incorrectly neutralized output in logs can potentially lead to log forging or the injection of malicious content.

Detector ID
csharp/log-injection@v1.0
Category
Common Weakness Enumeration (CWE) external icon

Noncompliant example

1public void LogInjectionNoncompliant()
2{
3    using var log = new LoggerConfiguration().WriteTo.Console().CreateLogger();
4    var pos = new { Latitude = 25, Longitude = 134 };
5    var elMs = 34;
6    // Noncompliant: String interpolation in log message.
7    log.Information($"Processed {pos} in {elMs:000} ms.");
8}

Compliant example

1public void LogInjectionCompliant()
2{
3    using var log = new LoggerConfiguration().WriteTo.Console().CreateLogger();
4    var pos = new { Latitude = 25, Longitude = 134 };
5    var elMs = 34;
6    // Compliant: Use structured logging.
7    log.Information("Processed {@Position} in {Elapsed:000} ms.", pos, elMs);
8}