Intermediate LevelWeb Security & Cyber Defense
What is Log Injection (CRLF Injection) and how do attackers forge audit log entries?
❓ Interview Prompt: Explain Log Injection, Carriage Return (`\r` / `%0D`) and Line Feed (`\n` / `%0A`) injection, forging log entries, and input sanitization.
Log Injection (CRLF Injection) occurs when un-sanitized user input containing newline characters ('\r\n') is written directly into system log files:
Attack Scenario:
User enters username: 'alice\n[INFO] 2026-07-28 10:00:00 - User admin logged in successfully'.
When logged, the raw newline character creates a fake log line, tricking security auditors into believing an admin logged in!
Code Implementation Example
typescript
export function sanitizeLogInput(input: string): string {
// Replace newline Carriage Return (\r) and Line Feed (\n) characters with spaces
return input.replace(/[\r\n]/g, ' ');
}
// Safe logging:
logger.info('User login attempt for: ${sanitizeLogInput(username)}');💡Sanitizing carriage return and line feed characters before writing to log files.
🎯 Interview Key Takeaway
Strip carriage return and line feed characters from user inputs before logging to prevent log injection forgery.
#Log Injection#CRLF#Sanitization#Intermediate
Back to all Web Security & Cyber Defense Questions→