How to Fix Log Injection and Log Forging Vulnerabilities

In this tutorial, you'll learn about How to Fix Log Injection and Log Forging Vulnerabilities. We cover key concepts, practical examples, and best practices.

Log injection (also called log forging) vulnerabilities occur when user input is written to logs without sanitization, allowing attackers to inject fake log entries, CRLF sequences, or control characters that corrupt log analysis and evade detection.

Quick Fix

Wrong

logger.info("User " + username + " logged in from " + ip);

If username is admin\n[INFO] User admin logged in from 127.0.0.1, a fake log entry is injected that may be trusted by log analysis tools.

Right

std::string sanitize(const std::string& input) {
    std::string result;
    for (char c : input) {
        if (c == '\n") result += "\\n";
        else if (c == "\r") result += "\\r";
        else if (c == "\t') result += "\\t";
        else result += c;
    }
    return result;
}

logger.info("User " + sanitize(username) +
    " logged in from " + sanitize(ip));

Fix with structured logging

// Use structured logging with fields
logger.info("User login", {
    {"username", username},
    {"ip", ip},
    {"timestamp", now()}
});

Fix with parameterized logging

// Modern loggers use parameterized format strings
logger.info("User {} logged in from {}", username, ip);
// The logger handles escaping of parameters

Fix for HTTP header logging

std::string userAgent = sanitizeForLogs(
    request.header("User-Agent"));
logger.info("Request from {}", userAgent);

Prevention

• Sanitize or encode user input before writing to logs.
• Use structured logging that separates data from format.
• Use parameterized log format strings (like {} placeholders).
• Remove or encode CRLF characters and control characters.
• Validate and truncate input to reasonable lengths before logging.

DodaTech Tools

Doda Browser's log injection scanner tests for CRLF injection and log forging payloads. DodaZIP encrypts and verifies log integrity with HMAC signatures. Durga Antivirus Pro detects log injection attacks in real time.

Common Mistakes with injection

1. Forgetting that lazy evaluation defers computation until the value is forced, causing space leaks with unevaluated thunks
2. Using return to exit a function early instead of wrapping a pure value in the monad
3. Mixing let bindings with <- bindings in do notation, producing type errors

These mistakes appear frequently in real-world LOG code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ