Description

This vulnerability detector identifies Django log injection (log forging) vulnerabilities where user-controlled input is written to log files without proper sanitization. Attackers can exploit this to inject malicious content into logs, potentially leading to log tampering, information disclosure, or misleading security monitoring.

Detection Strategy

• Reports vulnerabilities when Django framework is imported in the codebase

• Identifies logging operations using Django's logging mechanism or logger factory methods

• Detects when user-controlled input (from Django request objects, forms, or user input sources) flows directly into logging statements without proper validation or sanitization

• Triggers on logging calls where the logged content contains unsanitized data that originates from HTTP requests or other user input sources

Vulnerable code example

from django.http import HttpResponse
from loguru import logger as loguru_logger
import structlog

struct_logger = structlog.get_logger()

def vulnerable_logging(request):
    user_input = request.GET.get("query")...

✅ Secure code example

import re

from django.http import HttpResponse
from loguru import logger as loguru_logger
import structlog

struct_logger = structlog.get_logger()
...