Log injection is a vulnerability where an attacker appends a fake log message to a log file. Is there a recommended way to prevent this while logging to a file with NLog?
If my application logs something like this:
nlog.Info("User login failed: {}", username);
And someone attempts to log in using the following username:
alice"\r\n2022-09-14 11:08:46.1717|0|INFO|Program|User logged in: "bob
My log now shows this:
2022-09-14 11:12:27.7544|0|INFO|Program|User login failed: "alice"
2022-09-14 11:08:46.1717|0|INFO|Program|User logged in: "bob"
The second line is not actually logged by the application, but added by the user of the application.
Is there any recommended escaping method that can be configured, or some other method to prevent this issue?