SYeleswarapu097347 (Community Member) asked a question.
We are working on python and when we scan our scripts we are getting CEW-117 Impropert neutralization of logs error. They are suggesting to use OWASP ESAPI library but that library was not available for python. Can you please help me to resolve that flaw.
I have also tried replacing \r and \n with '_' but no use.
.png){kind=logo}
Hello @SYeleswarapu097347!
Unfortunately, Veracode does not recognize any cleansers in Python presently. This means it will report flaws but not be able to understand any code mitigations. You will need to mitigate these flaws in the platform and select “Mitigate by Design”, specifying the action steps that you took to defend the flaw. For a list if supported cleansers you can visit our help documentation here https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/y52kZojXR27Y8XY51KtvvA
In terms of protection, python has some good encoding baked in. I would recommend encoding your log message before logging using .encode(“string_escape”). This will correctly encode the CRLF characters and mitigating log forgery attacks.
import logging
logging.basicConfig(
filename='C:/temp/python.log',
format='%(message)s',
Level=logging.WARN)
tainted_message = 'jam\n\rjam' # contains CRLF
logging.warn(tainted_message) # New lines between the messages in log
escaped_message = tainted_message.encode('string_escape') # escapes the CRLF
logging.warn(escaped_message) # CRLF encoded correctly to a single line
As stated above, Veracode will still not recognise the fix and resolve the flaw. A mitigation will still need entered into the Platform, detailing the encoding mechanism for review by your security team.
Thanks! Seb
loggingExample