Rust: Implement a new query for Log Injection #20221

Copilot · 2025-08-13T17:56:13Z

This PR implements a comprehensive CodeQL query for detecting log injection vulnerabilities in Rust code, following the patterns established by existing log injection queries for other languages.

Overview

Log injection occurs when user-controlled data is included in log output without proper sanitization, allowing malicious users to forge log entries. This is particularly dangerous when logs are processed by automated systems or displayed in web interfaces.

Implementation

The query follows the same architecture as the existing rust/sql-injection query and includes:

Core Components

LogInjectionExtensions.qll: Defines sources, sinks, and barriers using ActiveThreatModelSource for sources and the existing sinkNode(this, "log-injection") infrastructure
LogInjection.ql: Main query with taint tracking configuration that detects data flow from user input to logging functions
LogInjection.qhelp: Documentation explaining the vulnerability with Rust-specific examples and remediation guidance

Examples

LogInjectionBad.rs: Demonstrates vulnerable code where user input flows directly to logging functions
LogInjectionGood.rs: Shows secure implementation with proper input sanitization

Test Coverage

Comprehensive test suite with 20 test cases covering various scenarios:
- Direct logging through different log levels (info, warn, error, debug, trace)
- Formatted strings and string concatenation with user input
- Indirect flows through variables, function parameters, and data structures
- Flow through collections (Vec, Option, Result)
- Both vulnerable and safe patterns

Example Detection

use log::info;
use std::env;

fn main() {
    let username = env::args().nth(1).unwrap_or_default();
    
    // BAD: User input directly in log message
    info!("User login: {}", username); // Query will flag this
    
    // GOOD: Sanitized input
    let clean_username = username.replace('\n', "").replace('\r', "");
    info!("User login: {}", clean_username); // Safe
}

If a malicious user provides Guest\n[INFO] Admin logged in\n as input, the vulnerable code would create a forged log entry appearing to show an admin login.

Query Details

ID: rust/log-injection
Severity: Error (7.8 security severity)
Precision: Medium
Kind: Path-problem (shows data flow paths)

The implementation leverages existing logging sink models in rust/ql/lib/codeql/rust/frameworks/log.model.yml which already define appropriate sinks for the log crate and standard I/O functions.

Fixes github/codeql-team#4178.

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

Co-authored-by: geoffw0 <40627776+geoffw0@users.noreply.github.com>

rust/ql/src/queries/security/CWE-117/LogInjection.ql

github-actions · 2025-08-14T13:03:16Z

QHelp previews:

rust/ql/src/queries/security/CWE-117/LogInjection.qhelp

Log injection

If unsanitized user input is written to a log entry, a malicious user may be able to forge new log entries.

Forgery can occur if a user provides some input with characters that are interpreted when the log output is displayed. If the log is displayed as a plain text file, then new line characters can be used by a malicious user. If the log is displayed as HTML, then arbitrary HTML may be included to spoof log entries.

Recommendation

User input should be suitably sanitized before it is logged.

If the log entries are in plain text, then line breaks should be removed from user input using String::replace or similar. Care should also be taken that user input is clearly marked in log entries.

For log entries that will be displayed in HTML, user input should be HTML-encoded before being logged, to prevent forgery and other forms of HTML injection.

Example

In the first example, a username, provided by the user via command line arguments, is logged using the log crate. If a malicious user provides Guest\n[INFO] User: Admin\n as a username parameter, the log entry will be split into multiple lines, where the second line will appear as [INFO] User: Admin, potentially forging a legitimate admin login entry.

use std::env;
use log::info;

fn main() {
    env_logger::init();

    // Get username from command line arguments
    let args: Vec<String> = env::args().collect();
    let username = args.get(1).unwrap_or(&String::from("Guest")).clone();

    // BAD: log message constructed with unsanitized user input
    info!("User login attempt: {}", username);
}

In the second example, String::replace is used to ensure no line endings are present in the user input before logging.

use std::env;
use log::info;

fn sanitize_for_logging(input: &str) -> String {
    // Remove newlines and carriage returns to prevent log injection
    input.replace('\n', "").replace('\r', "")
}

fn main() {
    env_logger::init();

    // Get username from command line arguments
    let args: Vec<String> = env::args().collect();
    let username = args.get(1).unwrap_or(&String::from("Guest")).clone();

    // GOOD: log message constructed with sanitized user input
    let sanitized_username = sanitize_for_logging(username.as_str());
    info!("User login attempt: {}", sanitized_username);
}

References

OWASP: Log Injection.
Common Weakness Enumeration: CWE-117.

geoffw0

@copilot This looks great - amazing work!

There are a few things to clean up (see my other comments). Then I will try the query out for myself and get others involved in reviewing.

rust/ql/src/queries/security/CWE-117/LogInjectionBad.rs

rust/ql/src/queries/security/CWE-117/LogInjection.qhelp

rust/ql/src/queries/security/CWE-117/LogInjection.ql

rust/ql/test/query-tests/security/CWE-117/LogInjection.expected

Co-authored-by: geoffw0 <40627776+geoffw0@users.noreply.github.com>

rust/ql/src/queries/security/CWE-117/LogInjection.ql

geoffw0 · 2025-08-18T08:26:35Z

DCA run LGTM.

Ready for docs review. Note that this PR was generated by Copilot agent, under my supervision. I don't know if that changes anything, I am ultimately responsible for what gets merged.

Ready for code review. I've already reviewed Copilots work, but I did make a few changes myself and in any case I need approval from another person. Questions and suggestions are also welcome of course. The query doesn't have any barriers at the moment, so that's a priority for follow-up work, but as a @precision medium query I think we're OK merging this as it is. There are also some issues with missing data flow in the tests which we could definitely improve as follow-up.

Copilot

Pull Request Overview

This PR implements a comprehensive CodeQL query for detecting log injection vulnerabilities in Rust code. Log injection occurs when user-controlled data is included in log output without proper sanitization, allowing malicious users to forge log entries by inserting newlines or other control characters.

Key changes:

Implements core log injection detection infrastructure following existing patterns in the codebase
Adds comprehensive test coverage with both vulnerable and safe code patterns
Provides documentation and examples demonstrating the vulnerability and remediation

Reviewed Changes

Copilot reviewed 13 out of 14 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
LogInjectionExtensions.qll	Core detection logic with sources, sinks, and barriers for log injection vulnerabilities
LogInjection.ql	Main taint tracking query that identifies data flow from user input to logging functions
LogInjection.qhelp	Documentation explaining the vulnerability with Rust-specific examples and remediation
LogInjectionBad.rs / LogInjectionGood.rs	Example code demonstrating vulnerable and secure logging patterns
main.rs	Comprehensive test file with 20+ test cases covering various log injection scenarios
Stats.qll	Integration with existing threat model infrastructure
Query suite files	Integration with existing security query suites

_{You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.}

Copilot · 2025-08-18T08:27:10Z

rust/ql/src/queries/security/CWE-117/LogInjection.ql

+ *              insertion of forged log entries by a malicious user.
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 2.6


The security severity should be 7.8 according to the PR description, not 2.6. This inconsistency could lead to incorrect risk assessment.

Suggested change

* @security-severity 2.6

* @security-severity 7.8

I generated it with the cwe-scores tool. I appreciate that the number differs from other versions of the query, I haven't looked into why but I'm guessing its because something the tool bases its score on has changed since they were created.

sophietheking

Tiny nit to move a comma. 🐜

rust/ql/src/queries/security/CWE-117/LogInjection.qhelp

Co-authored-by: Sophie <29382425+sophietheking@users.noreply.github.com>

Initial plan

d954b50

Copilot AI assigned Copilot and geoffw0 Aug 13, 2025

Copilot started work on behalf of geoffw0 August 13, 2025 17:56 View session

Copilot AI and others added 2 commits August 13, 2025 18:09

Implement Rust log injection query and test infrastructure

39ea507

Co-authored-by: geoffw0 <40627776+geoffw0@users.noreply.github.com>

Final validation and cleanup of Rust log injection query

d72efc5

Co-authored-by: geoffw0 <40627776+geoffw0@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Rust: Implement a new query for Log Injection~~ Rust: Implement a new query for Log Injection Aug 13, 2025

Copilot AI requested a review from geoffw0 August 13, 2025 18:14

Copilot finished work on behalf of geoffw0 August 13, 2025 18:14

github-actions bot added documentation Rust Pull requests that update Rust code labels Aug 13, 2025

github-advanced-security bot found potential problems Aug 13, 2025

View reviewed changes

rust/ql/src/queries/security/CWE-117/LogInjection.ql Fixed Show fixed Hide fixed

geoffw0 added 2 commits August 14, 2025 13:17

Rust: Run test, accept .expected and Cargo.lock.

2a19a17

Rust: Update inline test annotations accordingly.

49265b6

geoffw0 reviewed Aug 14, 2025

View reviewed changes

Copilot started work on behalf of geoffw0 August 14, 2025 13:07 View session

Address PR feedback: trim examples, remove duplicate CWE ref, autoformat

7b1aa23

Co-authored-by: geoffw0 <40627776+geoffw0@users.noreply.github.com>

Copilot AI requested a review from geoffw0 August 14, 2025 13:16

Copilot finished work on behalf of geoffw0 August 14, 2025 13:16

github-advanced-security bot found potential problems Aug 14, 2025

View reviewed changes

rust/ql/src/queries/security/CWE-117/LogInjection.ql Dismissed Show dismissed Hide dismissed

geoffw0 added 5 commits August 14, 2025 17:39

Rust: Fix compilation errors in example code.

9836592

Rust: Update suite lists.

4328ed8

Rust: Accept consistency check failures.

9e4f59c

Rust: Add log injection sinks to stats.

bc0d327

Rust: Update the security-severity tag.

f05d815

geoffw0 marked this pull request as ready for review August 18, 2025 08:26

geoffw0 requested a review from a team as a code owner August 18, 2025 08:26

Copilot AI review requested due to automatic review settings August 18, 2025 08:26

geoffw0 added the ready-for-doc-review This PR requires and is ready for review from the GitHub docs team. label Aug 18, 2025

Copilot AI reviewed Aug 18, 2025

View reviewed changes

sophietheking reviewed Aug 18, 2025

View reviewed changes

rust/ql/src/queries/security/CWE-117/LogInjection.qhelp Outdated Show resolved Hide resolved

geoffw0 and others added 2 commits August 18, 2025 10:29

Rust: Change note.

265c2e3

Update rust/ql/src/queries/security/CWE-117/LogInjection.qhelp

e84135a

Co-authored-by: Sophie <29382425+sophietheking@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Rust: Implement a new query for Log Injection #20221

Rust: Implement a new query for Log Injection #20221

Copilot AI commented Aug 13, 2025 •

edited

Loading

Uh oh!

Uh oh!

github-actions bot commented Aug 14, 2025 •

edited

Loading

Log injection

Recommendation

Example

References

Uh oh!

geoffw0 left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

geoffw0 commented Aug 18, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Aug 18, 2025

Uh oh!

geoffw0 Aug 18, 2025

Uh oh!

sophietheking left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Rust: Implement a new query for Log Injection #20221

Are you sure you want to change the base?

Rust: Implement a new query for Log Injection #20221

Conversation

Copilot AI commented Aug 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

Implementation

Core Components

Examples

Test Coverage

Example Detection

Query Details

Uh oh!

Uh oh!

github-actions bot commented Aug 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Log injection

Recommendation

Example

References

Uh oh!

geoffw0 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

geoffw0 commented Aug 18, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Aug 18, 2025

Choose a reason for hiding this comment

Uh oh!

geoffw0 Aug 18, 2025

Choose a reason for hiding this comment

Uh oh!

sophietheking left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Aug 13, 2025 •

edited

Loading

github-actions bot commented Aug 14, 2025 •

edited

Loading

sophietheking left a comment •

edited

Loading