https://github.com/python/cpython/commit/301b29dd306030ad4b02909d822c49cc8e05ca7d
commit: 301b29dd306030ad4b02909d822c49cc8e05ca7d
branch: main
author: Vinay Sajip <vinay_sa...@yahoo.co.uk>
committer: vsajip <vinay_sa...@yahoo.co.uk>
date: 2025-07-09T08:30:56+01:00
summary:
gh-94503: Update logging cookbook example with info on addressing log
injection. (GH-136446)
Co-authored-by: Stan Ulbrych <89152624+stanfromirel...@users.noreply.github.com>
files:
M Doc/howto/logging-cookbook.rst
diff --git a/Doc/howto/logging-cookbook.rst b/Doc/howto/logging-cookbook.rst
index ae2697fbce30ad..52537a91df542c 100644
--- a/Doc/howto/logging-cookbook.rst
+++ b/Doc/howto/logging-cookbook.rst
@@ -4140,6 +4140,42 @@ The script, when run, prints something like:
2025-07-02 13:54:47,234 DEBUG fool me ...
2025-07-02 13:54:47,234 DEBUG can't get fooled again
+If, on the other hand, you are concerned about `log injection
+<https://owasp.org/www-community/attacks/Log_Injection>`_, you can use a
+formatter which escapes newlines, as per the following example:
+
+.. code-block:: python
+
+ import logging
+
+ logger = logging.getLogger(__name__)
+
+ class EscapingFormatter(logging.Formatter):
+ def format(self, record):
+ s = super().format(record)
+ return s.replace('\n', r'\n')
+
+ if __name__ == '__main__':
+ h = logging.StreamHandler()
+ h.setFormatter(EscapingFormatter('%(asctime)s %(levelname)-9s
%(message)s'))
+ logging.basicConfig(level=logging.DEBUG, handlers = [h])
+ logger.debug('Single line')
+ logger.debug('Multiple lines:\nfool me once ...')
+ logger.debug('Another single line')
+ logger.debug('Multiple lines:\n%s', 'fool me ...\ncan\'t get fooled
again')
+
+You can, of course, use whatever escaping scheme makes the most sense for you.
+The script, when run, should produce output like this:
+
+.. code-block:: text
+
+ 2025-07-09 06:47:33,783 DEBUG Single line
+ 2025-07-09 06:47:33,783 DEBUG Multiple lines:\nfool me once ...
+ 2025-07-09 06:47:33,783 DEBUG Another single line
+ 2025-07-09 06:47:33,783 DEBUG Multiple lines:\nfool me ...\ncan't get
fooled again
+
+Escaping behaviour can't be the stdlib default , as it would break backwards
+compatibility.
.. patterns-to-avoid:
_______________________________________________
Python-checkins mailing list -- python-checkins@python.org
To unsubscribe send an email to python-checkins-le...@python.org
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: arch...@mail-archive.com
