Description

This detector identifies when sensitive information is being logged using SLF4J logging frameworks in Java applications. Logging sensitive data like passwords, API keys, or personal information can expose it in log files, making it accessible to unauthorized users who have access to application logs.

Detection Strategy

• The code must import SLF4J logging libraries (either org.slf4j.* or both org.slf4j.Logger and org.slf4j.LoggerFactory)

• A logging method call must be identified (such as logger.info(), logger.debug(), logger.error(), etc.)

• At least one argument passed to the logging method must contain tainted/sensitive data that could expose confidential information

Vulnerable code example

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.bind.annotation.*;
import javax.servlet.http.HttpServletRequest;

@RestController
public class AuthController {
    private Logger logger = LoggerFactory.getLogger(AuthController.class);...

✅ Secure code example

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.bind.annotation.*;
import javax.servlet.http.HttpServletRequest;

@RestController
public class AuthController {
    private Logger logger = LoggerFactory.getLogger(AuthController.class);...