Description

This detector identifies unsafe logger injection vulnerabilities in Java code where user-controlled input is directly passed to logging methods without proper sanitization. This can lead to log injection attacks where malicious users can manipulate log entries, potentially causing log forgery, information disclosure, or downstream security issues when logs are processed by other systems.

Detection Strategy

• The code must import Java logging libraries (java.util.logging.Logger, java.util.logging.*, org.slf4j, org.apache.logging.log4j or lombok.extern)

• A logging method call must be identified (such as info, warn, error, debug, trace, or similar logging methods)

• The method call must be invoked on a Logger object, obtained from Logger.getLogger, LoggerFactory.getLogger or LogManager.getLogger, or the log field generated by Lombok @Slf4j, @Log4j2 or @Log4j

• At least one argument of the logging method must contain user-controlled input from an HttpServletRequest (such as getParameter, getHeader, getQueryString, getRequestURL or getRequestURI) or data that can be influenced by external sources

• All conditions must be met simultaneously - if any logging library import is missing or the argument doesn't contain user input, no vulnerability is reported

Vulnerable code example

import java.util.logging.Logger;
import javax.servlet.http.HttpServletRequest;

public class LogInjectionExample {
    private static final Logger LOGGER = Logger.getLogger(LogInjectionExample.class.getName());

    public void unsafeLogging(HttpServletRequest request) {
        String userInput = request.getParameter("username");...

✅ Secure code example

import java.util.logging.Logger;
import javax.servlet.http.HttpServletRequest;

public class LogInjectionExample {
    private static final Logger LOGGER = Logger.getLogger(LogInjectionExample.class.getName());

    public void unsafeLogging(HttpServletRequest request) {
        String userInput = request.getParameter("username");...