Pensar - auto fix for Unsanitized Twitter Handle Log Injection Vulnerability

[pensarappdev]

• Log Injection Fix (CWE-117):
  • Added the private helper method _neutralize_for_log inside Utils. This function replaces any \r and \n characters in user input with the literal string representations (\\r and \\n) and removes escape sequences with regex.
  • In the user_lookup_sns method, before logging the username, the username is passed through this sanitization function, and only the safe version is included in the log message:
    • logger.info(f"Pulling {safe_user}'s tweets")
  • This prevents attackers from injecting newlines, control characters, or terminal escape sequences into logs, blocking log injection attacks.
• No dependency issues were reported, so no changes were made to package management or imports.
• All other code, formatting, whitespace, and logic not identified in the vulnerability metadata remains unchanged.

More Details

Type	Identifier	Message	Severity	Link
Application	CWE-117	Untrusted input (the user handle) is written directly to the application logs without any neutralization. A malicious user could supply a handle containing new-line characters, carriage returns, or ANSI escape codes (e.g. "bob\n[ERROR] Database failure") and thereby inject forged log entries, confuse log parsers, or hide malicious activity. This is an Improper Output Neutralization for Logs issue.	medium	Link