SEC018
Log injection
Object Pascal — Delphi & Free Pascal
Info
Security
Unsanitized user data in logs can forge entries or inject control characters
unsanitized user data in logs can forge entries or inject control characters.
Why this severity
unsanitized user data in logs can forge entries or inject control characters.
Known false positives
logging of constants or pre-validated internal identifiers.
Remediation example
Log(SanitizeLogEntry(UserInput)); // strip newlines and control characters first