| शीर्षक | kitsada8621 Digital-Library-Management-System 1.0 Improper Output Neutralization for Logs |
|---|
| विवरण | header := ctx.GetHeader("Authorization")
if header == "" {
ctx.JSON(http.StatusUnauthorized, models.ResponseJson{
Success: false,
Message: "authorization is required",
})
ctx.Abort()
return
}
parts := strings.Split(header, " ")
fmt.Println(parts)
In line 28 of the middleware/jwt_refresh_token_middleware.go file, the program uses fmt.Println(parts) to print the split header (the value obtained from the Authorization header). This is a potential security risk because if the value is controlled by the user (which appears to be the case based on the code snippet provided), an attacker may attempt to inject malicious content in the header to perform a log injection attack. Using unverified or uncleaned user input during logging may lead to security issues such as sensitive information disclosure and tampering of log files. This situation is one of the common forms of log injection vulnerability. Therefore, you should not output unprocessed user input directly into the log file. |
|---|
| स्रोत | ⚠️ https://github.com/kitsada8621/Digital-Library-Management-System/issues/1 |
|---|
| उपयोगकर्ता | zihe (UID 56943) |
|---|
| सबमिशन | 20/08/2024 12:34 PM (2 साल पहले) |
|---|
| संयम | 29/08/2024 08:01 AM (9 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 276072 [kitsada8621 Digital Library Management System 1.0 jwt_refresh_token_middleware.go JwtRefreshAuth Authorization अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|