Log Injection Defenses: Sanitize User Fields in Structured JSON Loggers

User sets display_name = "alice\nERROR auth ok user=admin"
Plaintext logger:
  INFO user=alice
  ERROR auth ok user=admin   ← forged
JSON logger with raw concat can still break if you print strings by hand

import pino from "pino";

function scrub(value: unknown): unknown {
  if (typeof value !== "string") return value;
  return value
    .replace(/[\u0000-\u001f\u007f]/g, " ")
    .slice(0, 512);
}

const log = pino({
  level: "info",
  redact: {
    paths: ["req.headers.authorization", "password", "token", "*.secret"],
    censor: "[REDACTED]",
  },
  serializers: {
    user(u) {
      return { id: u.id, name: scrub(u.name) };
    },
  },
});

// GOOD
log.info({ user: { id, name: req.body.name } }, "profile_updated");

// BAD
console.log(`profile_updated name=${req.body.name}`);

import json
import logging
import re

_CTRL = re.compile(r"[\x00-\x1f\x7f]")

def scrub(s: str, limit: int = 512) -> str:
    return _CTRL.sub(" ", s)[:limit]

class JsonFormatter(logging.Formatter):
    def format(self, record: logging.LogRecord) -> str:
        payload = {
            "level": record.levelname,
            "msg": scrub(str(record.getMessage())),
            "correlation_id": scrub(getattr(record, "correlation_id", "")),
        }
        if hasattr(record, "user_name"):
            payload["user_name"] = scrub(str(record.user_name))
        return json.dumps(payload, ensure_ascii=False)

# GOOD: extra fields as structured keys
logger.info("profile_updated", extra={"user_name": scrub(name)})

# BAD
logger.info("profile_updated name=%s" % name)