114 vulnerabilities classified as CWE-117 (日志输出的转义处理不恰当). AI Chinese analysis included.
CWE-117 represents an input validation weakness where applications fail to properly sanitize external data before writing it to log files. This vulnerability allows attackers to inject malicious log entries, often by manipulating fields like usernames or URLs that are directly incorporated into log messages. Exploitation typically involves injecting newline characters or log-specific formatting codes to forge entries, which can obscure legitimate activity, create false alerts, or facilitate log injection attacks that lead to cross-site scripting or server-side request forgery. To prevent this, developers must implement strict output encoding and validation routines specifically for logging contexts. By treating all external input as untrusted and applying context-aware neutralization techniques, such as escaping special characters or using structured logging frameworks, engineers ensure that log data remains safe and interpretable, thereby maintaining the integrity and reliability of system audit trails.
String val = request.getParameter("val"); try { int value = Integer.parseInt(val); } catch (NumberFormatException) { log.info("Failed to parse val = " + val); } ...Vulnerabilities classified as CWE-117 (日志输出的转义处理不恰当) represent 114 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.