You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Security: amarin/logging
Security
docs/security.md
Security
Log injection. In the text format, control characters of the message and the logger name are escaped: a line feed is written as \n, a carriage return as \r, and other control characters (except tab, including DEL) as \xNN, so a multiline message cannot forge a record. Field values (WithKey) are escaped by zap in the JSON part of a text record, and by the encoder in json and syslog. The stack trace stays multiline. The original message cannot be restored unambiguously: a literal \n in the message looks the same as an escaped line feed.
Sensitive data. Values of fields whose keys are listed in redact (redact: [password, token], WithRedact) are replaced with *** in WithKey, WithKeys, WithValuesFrom, WithError (key error), fields taken from the context and static fields; the value itself is neither inspected nor encoded. Keys are compared as a whole, case-insensitively: token does not cover access_token, list it separately. Message text is not masked (Info("token=" + t) reaches the log as is), and neither are the contents of nested structures: only the top-level field is masked, by its key. Do not log secrets in message text.
Secret keys in code.RedactedKey[T] (const KeyPassword logging.RedactedKey[string] = "password") always writes ***; the value is neither kept nor encoded, whatever redact says. It intentionally has no Key() method and no SetToCtx. redact remains a safety net for the other keys.
File permissions. Files are created with 0640, not 0666. For wider access set the permissions beforehand or use umask/ACL.
Syslog over UDP is unencrypted and has no delivery guarantee; TCP has no TLS either, so do not send secrets over an untrusted network.
Panics. Logger methods do not panic on a nil context, a nil error or empty keys, by design (empty keys are skipped). MustInit panics only on an invalid configuration. A LoggingValues method or a context extractor you wrote can panic, and the package does not recover from that (hook functions are recovered).
Panic (Panicer) writes a record and panics with the message string, whatever the logger level.
Fatal exits the process with os.Exit(1) after writing; deferred functions do not run.
Level control over HTTP.LevelsHandler is disabled by default (404) and is enabled only by an explicit levelsEndpoint: true. It has no authentication: enable it on a closed administrative port only.