go/gosec
1
0
Fork 0
mirror of https://github.com/securego/gosec.git synced 2026-06-20 00:15:59 +02:00
Code Issues Releases Activity

fix(G706): scope slog sinks to msg arg only to prevent false positives on structured attributes (#1623)

Browse Source 
slog attribute values are auto-escaped by TextHandler/JSONHandler; only the message arg is a real injection vector.

Fixes: #1622
This commit is contained in:
Ravi Sastry Kadali
2026-03-25 21:46:59 +01:00
committed by GitHub
parent 8d05295c5a
commit 844b1703bf
2 changed files with 74 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
analyzers/loginjection.go
+13 -4
View File
@@ -46,10 +46,19 @@ func LogInjection() taint.Config {
{Package: "log", Method: "Panic"},
{Package: "log", Method: "Panicf"},
{Package: "log", Method: "Panicln"},
{Package: "log/slog", Method: "Info"},
{Package: "log/slog", Method: "Warn"},
{Package: "log/slog", Method: "Error"},
{Package: "log/slog", Method: "Debug"},
// log/slog structured logging functions have the signature:
// func Warn(msg string, args ...any)
// The variadic `args` are key-value attribute pairs whose values are
// automatically escaped by both TextHandler (JSON-quoted) and JSONHandler
// (JSON-encoded), making them safe against log injection.
// Only the `msg` argument (args[0]) is a real injection vector because
// TextHandler writes it verbatim without quoting.
// CheckArgs: []int{0} scopes the taint check to the message only,
// preventing false positives on: slog.Warn("msg", "key", taintedVal)
{Package: "log/slog", Method: "Info", CheckArgs: []int{0}},
{Package: "log/slog", Method: "Warn", CheckArgs: []int{0}},
{Package: "log/slog", Method: "Error", CheckArgs: []int{0}},
{Package: "log/slog", Method: "Debug", CheckArgs: []int{0}},
},
Sanitizers: []taint.Sanitizer{
// strings.ReplaceAll can strip newlines/CRLF for log injection