Insertion of Sensitive Information into Log File

// dto/UserRegistrationDto.java
public class UserRegistrationDto {
    private String username;
    private String password;
    // DANGEROUS: Default or custom toString() might include password.
    @Override public String toString() {
        return "UserRegistrationDto{" + "username='" + username + '\'' +
               ", password='" + password + '\'' + '}'; // Leaks password
    }
    // ... getters/setters ...
}

// controller/RegistrationController.java
@PostMapping("/register")
public String register(@ModelAttribute("user") UserRegistrationDto dto) {
    // DANGEROUS: Logging the DTO object calls its toString() method.
    log.info("Registering user: {}", dto); // Logs password
    // ... registration logic ...
}

// filter/LoggingFilter.java
@Component
public class LoggingFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        // DANGEROUS: If request body is read and logged here,
        // it will include passwords, tokens, etc., from login or API requests.
        // String requestBody = ... read request.getInputStream() ...
        // log.debug("Request body: {}", requestBody);
        chain.doFilter(request, response);
    }
}

// dto/UserRegistrationDto.java (Secure toString())
public class UserRegistrationDto {
    private String username;
    private String password;
    // SECURE: Overridden toString() masks the password.
    @Override public String toString() {
        return "UserRegistrationDto{" + "username='" + username + '\'' +
               ", password='****'" + '}'; // Password masked
    }
    // ... getters/setters ...
}

// controller/RegistrationController.java (Secure Logging)
@PostMapping("/register")
public String register(@ModelAttribute("user") UserRegistrationDto dto) {
    // SECURE: Even if DTO is logged, toString() masks the password.
    log.info("Registering user: {}", dto);
    // Better: Log only what's needed
    // log.info("Registering user: {}", dto.getUsername());
    // ... registration logic ...
}

// logback-spring.xml (Secure - Masking Pattern Example)

// Models/RegistrationViewModel.cs
public class RegistrationViewModel {
    public string Email { get; set; }
    [DataType(DataType.Password)]
    public string Password { get; set; } // Sensitive data
    // Default .ToString() might just show class name, but logging
    // via JSON serialization will expose it.
}

// Controllers/AccountController.cs
public async Task<IActionResult> Register(RegistrationViewModel model)
{
    // DANGEROUS: Logging the entire model object. If using structured logging
    // (like Serilog), this serializes the object, including the Password.
    _logger.LogInformation("New user registration attempt: {@RegistrationModel}", model);

    // ... registration logic ...
}

// Controllers/ApiController.cs
public async Task<IActionResult> CallExternalApi([FromBody] ApiRequest request)
{
    try {
        // Assume request object contains 'ApiKey'
        await _apiService.Call(request.ApiKey, request.Data);
    }
    catch (ApiException ex) {
        // DANGEROUS: Exception 'ex' might contain the ApiKey in its
        // message or properties, and it's logged.
        _logger.LogWarning("API call failed: {Exception}", ex);
        return StatusCode(500, ex.Message); // Also potentially CWE-209
    }
}

// Models/RegistrationViewModel.cs (Secure - No change needed here, fix is in logging)

// Controllers/AccountController.cs (Secure Logging)
public async Task<IActionResult> Register(RegistrationViewModel model)
{
    // SECURE: Log only non-sensitive properties.
    _logger.LogInformation("New user registration attempt for: {Email}", model.Email);
    
    // OR use a DTO/ViewModel without the password for logging
    // var logModel = new { Email = model.Email }; // Create anonymous type
    // _logger.LogInformation("New user registration attempt: {@LogModel}", logModel);

    // ... registration logic ...
}

// Program.cs (Secure Serilog Destructuring - Conceptual)
// using Serilog;
// Log.Logger = new LoggerConfiguration()
//     .Destructure.ByTransforming<RegistrationViewModel>(r => new {
//         // SECURE: Transform object during logging to exclude password
//         Email = r.Email,
//         Password = "****" // Masked
//     })
//     .WriteTo.Console()
//     .CreateLogger();

// Controllers/ApiController.cs (Secure Exception Logging)
public async Task<IActionResult> CallExternalApi([FromBody] ApiRequest request)
{
    try {
         await _apiService.Call(request.ApiKey, request.Data);
    }
    catch (ApiException ex) {
        // SECURE: Log exception, but avoid logging request object directly.
        // The default logging for 'ex' usually includes Message + StackTrace.
        // Ensure ex.Message itself doesn't contain the secret!
         _logger.LogWarning(ex, "API call failed for request ID {RequestId}. Error: {ErrorMessage}",
             request.RequestId, // Assume RequestId exists and is safe
             ex.Message); // If ex.Message is unsafe, sanitize it too.
        return StatusCode(500, "API call failed."); // Generic error
    }
}

// app/Http/Middleware/RequestLogger.php
use Illuminate\Support\Facades\Log;
class RequestLogger
{
    public function handle(Request $request, Closure $next)
    {
        // DANGEROUS: Logs all input fields, including 'password', 'token', etc.
        Log::info('Incoming Request:', $request->all());
        return $next($request);
    }
}

// app/Http/Controllers/SomeController.php
public function someAction(Request $request)
{
    $user = auth()->user();
    // DANGEROUS: If User object's 'toArray()' or serialization
    // includes sensitive fields (e.g., 'remember_token', 'api_key'),
    // logging the object will expose them.
    Log::debug('Processing action for user:', ['user' => $user]);
    // ...
}

// config/logging.php (Secure - Parameter Filtering)
'channels' => [
    'stack' => [
        'driver' => 'stack',
        'channels' => ['single'],
        // ...
    ],
    'single' => [
        'driver' => 'single',
        'path' => storage_path('logs/laravel.log'),
        'level' => env('LOG_LEVEL', 'debug'),
        // SECURE: Add processors to tap Monolog
        'processors' => [
            // Example: Add processor to filter *all* log records
            // App\Logging\SanitizeLogProcessor::class,
        ],
    ],
    // ...
],
// OR (simpler, for request params):
// config/app.php
// 'log' => env('APP_LOG', 'stack'),
// 'log_level' => env('APP_LOG_LEVEL', 'debug'),
// (This might be in config/logging.php in newer Laravel)
// Note: Laravel's default logging often filters params based on
// App\Http\Middleware\TrimStrings::$except and similar lists, or
// via config/logging.php 'processors'
// Explicit filtering in middleware is also safe:

// app/Http/Middleware/RequestLogger.php (Secure)
public function handle(Request $request, Closure $next)
{
    // SECURE: Use except() to remove sensitive fields before logging.
    $logData = $request->except(['password', 'password_confirmation', 'api_key', '_token']);
    Log::info('Incoming Request:', $logData);
    return $next($request);
}

// app/Models/User.php (Secure - Hiding sensitive fields from array/JSON)
class User extends Authenticatable
{
    // SECURE: Fields hidden from array/JSON serialization (used by logger)
    protected $hidden = [
        'password',
        'remember_token',
        'api_token', // Example sensitive field
    ];
}

// app.js (Express)
// Assume winston logger is configured
const logger = require('./logger');

app.post('/login', (req, res) => {
    // DANGEROUS: Logs the full request body, including password.
    logger.info('Login attempt:', { body: req.body });
    // ... auth logic ...
});

// services/userService.js
async function findUser(username) {
    const user = await User.findOne({ username }); // Assume returns Mongoose model
    // DANGEROUS: Logging the full user object might include
    // passwordHash, resetToken, etc.
    logger.debug('Found user:', { user: user });
    return user;
}

// logger.js (Winston Secure Configuration - Conceptual)
const winston = require('winston');
const { combine, timestamp, json, prettyPrint } = winston.format;

// SECURE: Create a custom format to redact sensitive keys
const redactFormat = winston.format((info, opts) => {
    // Simple recursive redact function (needs to be robust)
    function redact(obj) {
        if (typeof obj !== 'object' || obj === null) return obj;
        if (Array.isArray(obj)) return obj.map(redact);
        
        const newObj = {};
        for (const key in obj) {
            if (Object.prototype.hasOwnProperty.call(obj, key)) {
                 if (['password', 'token', 'apiKey', 'authorization', 'creditCard'].includes(key.toLowerCase())) {
                    newObj[key] = '****'; // Mask
                 } else {
                    newObj[key] = redact(obj[key]); // Recurse
                 }
            }
        }
        return newObj;
    }
    
    // Apply redaction to the whole info object (or specific parts)
    // This simple example just checks top-level 'message' if it's an object,
    // or 'body', 'user' etc. if they exist.
    if (info.message && typeof info.message === 'object') info.message = redact(info.message);
    if (info.body) info.body = redact(info.body);
    if (info.user) info.user = redact(info.user);
    // Also need to handle info itself if it was `logger.info({ password: '...' })`
    // A better approach might be to redact info.meta or the result of json()
    return redact(info); // Apply to whole info object
});

const logger = winston.createLogger({
    level: 'info',
    // SECURE: Combine timestamp, redaction, and final format
    format: combine(
        timestamp(),
        redactFormat(), // Apply custom redaction
        json() // Convert to JSON
    ),
    transports: [ new winston.transports.Console() ],
});
module.exports = logger;

// app.js (Usage)
app.post('/login', (req, res) => {
    // SECURE: Logger configuration will redact 'password' field
    logger.info('Login attempt:', { body: req.body, ip: req.ip });
    // ... auth logic ...
});

# app/controllers/payment_controller.rb
class PaymentController < ApplicationController
  def process_payment
    # DANGEROUS: params[:credit_card_number] and params[:cvv]
    # are not in the default filter list. Logging params will expose them.
    Rails.logger.info "Processing payment params: #{params.inspect}"
    # ... process ...
  end
end

# app/controllers/users_controller.rb
def show
  @user = User.find(params[:id])
  # DANGEROUS: If User model has custom sensitive attributes
  # (e.g., @api_key, @social_security_number) that are not
  # filtered, .inspect will log them.
  Rails.logger.debug "User object: #{@user.inspect}"
  # ...
end

# config/initializers/filter_parameter_logging.rb (Secure)
# Be sure to restart your server when you modify this file.

# SECURE: Add all custom sensitive parameter names.
# Rails filters parameters that *contain* these substrings (case-insensitive).
Rails.application.config.filter_parameters += [
  :password, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn, # Default Rails filters
  :api_key, :credit_card_number, :cvv, :card_number, :security_code # Add custom
]

# app/controllers/payment_controller.rb (Secure)
class PaymentController < ApplicationController
  def process_payment
    # SECURE: Logging params is now safe. Rails will filter
    # :credit_card_number and :cvv based on the initializer.
    Rails.logger.info "Processing payment params (filtered): #{params.inspect}"
    # ... process ...
  end
end

# app/models/user.rb (Secure - Override inspect)
class User < ApplicationRecord
  # ...
  attr_accessor :api_key # Example sensitive non-DB attribute
  # SECURE: Override inspect for logging safety.
  def inspect
    # Return only safe attributes
    "#<User id: #{id}, email: #{email}, created_at: #{created_at}>"
    # Or filter dynamically:
    # super.gsub(/@api_key=".*?"/, '@api_key="[FILTERED]"')
  end
end