ADev978897 (Community Member) asked a question.
Veracode : Improper Output Neutralization for Logs (CWEID 117)
How to address the CWE-117 issues that are reported by veracode. Have tried the suggested fixes for this issue from here
Some options explored with no improvements
- Suggested by veracode here
import logging
name = "bob"
logging.error("Hey there {}".format(name.encode()))
- Using the antricrlf library as a fromatter for the logger module.
import logging
import anticrlf
# setting up the anticrlf log formatter for the logging module.
formatter = anticrlf.LogFormatter()
handler.setFormatter(formatter)
logger = logging.getLogger("test")
logger.addHandler(handler)
name = "bob"
logger.error("Hey there : {} ".format(name))
The above solutions still resulted in veracode flagging them as CWE-117 : Improper Output Neutralization for Logs. Could someone suggest on how to address this issue.
Thanks!
.png){kind=logo}
Veracode does not recognize any cleansing function in Python for addressing CWE 117, CWE 93 or CWE 113. Here you may consider defining a custom cleansing function.
We recommend you to replace CRLF characters from the any of untrusted variable used in logging.
You can define a replaceCRLF() which recieves a string containing below CRL F characters and returns a new string replacing all the occurrences of them with either a hyphen, whitespace, or underscore. CRLF Characters are \n,\r,%0a,%0d, %0A, %0D.
Make sure you replace all occurrences of these characters from the given string.
- We recommend you to implement CRLF cleanser, and filter out CRLF characters like (\n, \r, %0a, %0A, %0D, %0d ) from those variables. [A method that accept a String and return a String by replacing all the CRLF characters from it. ]
Below is Java snippet only for understanding.
variableX = CRLFCleanser.clean(variableX);
public class CRLFCleanser{
public String clean(String str){
str = str.replaceAll("\n","").replaceAll("\r","").replaceAll("%0d","").replaceAll("%0D","").replaceAll("%0a","").replaceAll("%0A","");
retturn str;
}
}
If you already implemented a different mitigation approach where you have already tested and ensure that CRLF characters are taken care of. You can raise the mitigation proposal under action 'Mitigation By Design' by providing specification and verification details.
If you still have questions I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Regards,
Kashif