fix: sanitize message to prevent log injection

ONSdigital · Nov 5, 2024 · 0168d13 · 0168d13
1 parent 5a57a47
commit 0168d13
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/server/logger/cloudLogging.ts b/server/logger/cloudLogging.ts
@@ -15,11 +15,15 @@ export default class AuditLogger {
     }
 
     info(logger: IncomingMessage["log"], message: string): void {
-        logger.info(`AUDIT_LOG: ${message}`);
+        const logFormat = "AUDIT_LOG: message";
+        const log = logFormat.replace("message", message);
+        logger.info(log);
     }
 
     error(logger: IncomingMessage["log"], message: string): void {
-        logger.error(`AUDIT_LOG: ${message}`);
+        const logFormat = "AUDIT_LOG: message";
+        const log = logFormat.replace("message", message);
+        logger.error(log);
     }
 
     async getLogs(): Promise<AuditLog[]> {