Description

This vulnerability detector identifies log forging attacks in Flask applications where user-controlled input is directly logged without sanitization. When untrusted data flows into logging statements, attackers can inject malicious content to manipulate log files, potentially bypassing security monitoring or conducting log injection attacks.

Detection Strategy

• The code must import Flask library (uses 'flask' prefix imports)

• Logger objects must be present in the code (either standard loggers or factory-created loggers)

• A logging method call must contain Flask user input that flows directly from user-controlled sources

• The user input in the logging statement must not be properly sanitized or validated before being logged

Vulnerable code example

from flask import Flask, request
from loguru import logger as loguru_logger
import structlog

app = Flask(__name__)
struct_logger = structlog.get_logger()

@app.route("/search")...

✅ Secure code example

import re
from flask import Flask, request
from loguru import logger as loguru_logger
import structlog

app = Flask(__name__)
struct_logger = structlog.get_logger()
...