CVE-2020-36567: Go Log Injection Http Path Format
HTTP URL path or query string data is formatted with the '%s' verb, which does not escape newline characters. An attacker can inject arbitrary log entries by embedding newlines (CRLF) in a crafted request URL. Use '%#v' or '%q' as the format verb, or sanitize the value with strconv.Quote() before including it in log output.
Gogreprules fetch cve-2020-36567-go-log-injection-http-path-format --engine opengrepDescription
HTTP URL path or query string data is formatted with the '%s' verb, which does not escape newline characters. An attacker can inject arbitrary log entries by embedding newlines (CRLF) in a crafted request URL. Use '%#v' or '%q' as the format verb, or sanitize the value with strconv.Quote() before including it in log output.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.