Fix it in your stack

Tested fixes for CWE-117 in Express, Flask and Spring Boot: the vulnerable code, the fix, a plausible fix that still fails, and the regression tests.

Definition

MITRE’s description of CWE-117: The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.

Common consequences MITRE lists

  • Integrity, Confidentiality, Availability, Non-Repudiation: Modify Application Data; Hide Activities; Execute Unauthorized Code or Commands

Why it matters

Investigations depend on logs being trustworthy; forged or corrupted entries hide attacks, mislead responders and can attack the tools that display them.

How to prevent it

  • Use structured logging, such as JSON, so untrusted values stay inside fields.
  • Encode or remove newlines and control characters in values written to text logs.
  • Escape log data again when a web-based viewer displays it.

Guides on this site

Main subject · Guide

Prevent CRLF header injection, log forging and CSV formula injection

Carriage return and line feed separate HTTP header fields, log records and CSV rows, and a leading = turns a spreadsheet cell into a formula. Let the framework write headers, log structured JSON, and neutralize formula triggers in exports.

Also covers this · Guide

Create security logs someone can investigate

Record meaningful decisions with consistent structure, protect the resulting evidence, and prove that important events reach an operational owner.

References

  1. CWE-117 in the MITRE CWE list (version 4.20)
  2. OWASP Logging Cheat Sheet

List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.

CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.