<!DOCTYPE qhelp PUBLIC
  "-//Semmle//qhelp//EN"
  "qhelp.dtd">
<qhelp>
<overview>
<p>If unsanitized user input is written to a log entry, a malicious user may
be able to forge new log entries.</p>

<p>Forgery can occur if a user provides some input with characters that are interpreted
when the log output is displayed. If the log is displayed as a plain text file, then new
line characters can be used by a malicious user. If the log is displayed as HTML, then
arbitrary HTML may be include to spoof log entries.</p>
</overview>

<recommendation>
<p>
User input should be suitably encoded before it is logged.
</p>
<p>
If the log entries are plain text then line breaks should be removed from user input, using
<code>String.Replace</code> or similar. Care should also be taken that user input is clearly marked
in log entries, and that a malicious user cannot cause confusion in other ways.
</p>
<p>
For log entries that will be displayed in HTML, user input should be HTML encoded using
<code>HttpServerUtility.HtmlEncode</code> or similar before being logged, to prevent forgery and
other forms of HTML injection.
</p>

</recommendation>

<example>
<p>In the following example, a user name, provided by the user, is logged using a logging framework. In
the first case, it is logged without any sanitization. In the second case, <code>String.Replace</code>
is used to ensure no line endings are present in the user input.</p>
<sample src="LogForging.cs" />
</example>

<references>
<li>OWASP: <a href="https://www.owasp.org/index.php/Log_Injection">Log Injection</a>.</li>
</references>
</qhelp>
