3 ms·
Also beware of CWE-117
by avodonosov 7y ago
Also beware of CWE-117
- arendtio 7y agohttps://cwe.mitre.org/data/definitions/117.html https://cwe.mitre.org/data/definitions/117.html 'CWE-117: Improper Output Neutralization for Logs' That is something probably often forgotten when simply dumping some requests into a log, but at least it should be obvious that the source of the content is untrusted. On the other hand, a log file is a file on your server, so you would probably think of it as nothing dangerous, as everybody has cared about CWE-117, right? ;-)