Description

This detector identifies log injection vulnerabilities in Python applications using the Starlette web framework. Log injection occurs when untrusted user input is directly logged without sanitization, allowing attackers to manipulate log entries, potentially leading to log forging, information disclosure, or downstream attacks on log processing systems.

Detection Strategy

• Confirms the application imports the Starlette web framework (but excludes FastAPI applications since they have separate handling)

• Identifies logging operations using Python's standard logging mechanisms (logger objects and factory methods)

• Locates code that logs data originating from Starlette request objects (such as request parameters, headers, or body content)

• Reports a vulnerability when user-controlled input from Starlette requests flows directly into logging statements without proper sanitization or validation

Vulnerable code example

from starlette.requests import Request
from loguru import logger
import structlog

struct_logger = structlog.get_logger()

async def vulnerable_logging(request: Request):
    user_input = request.query_params.get("user", "")...

✅ Secure code example

import re
from starlette.requests import Request
from loguru import logger
import structlog

struct_logger = structlog.get_logger()

CONTROL_CHARS = re.compile(r"[\r\n\t\x00-\x1f\x7f]")...