Pensar - auto fix for Unsanitized User Input in Log Message Interpolation

[pensarappstaging]

Security issue fixed: Log injection vulnerability

In the user_lookup_sns method, user-supplied input (user) was interpolated directly into the log message:
logger.info(f"Pulling {user}'s tweets")
This could allow attackers to inject control characters or manipulate log contents.

How it was fixed:

• Added a helper method _sanitize_for_log to the Utils class, which:
  • Replaces newline and carriage return characters with escaped markers (\n, \r shown as \\n, \\r in logs)
  • Removes other ASCII control characters except tab, replacing them with ?
• Updated the logging statement to use:
  logger.info(f"Pulling {self._sanitize_for_log(user)}'s tweets")

Result:
Log entries will not contain injected line breaks or control sequences, thus preserving log integrity if user is attacker-controlled. Only the log output is sanitized; functionality using the unsanitized user variable elsewhere remains unchanged.

More Details

Type	Identifier	Message	Severity	Link
Application	CWE-117	The content of the user parameter is interpolated directly into a log message without any neutralization or sanitization. If an attacker can control the user value, they could inject control characters (e.g., \n, \r, ANSI escapes) or crafted text that forges log entries, obscures real logs, or triggers downstream log-parsing vulnerabilities. This is a classic log-injection flaw (CWE-117: Improper Output Neutralization for Logs).	medium	Link