Registry / observability / logging-formatter-anticrlf

logging-formatter-anticrlf

JSON →
library1.2.1pypypi✓ verified 83d ago

logging-formatter-anticrlf is a Python logging Formatter designed to prevent CRLF Injection (CWE-93 / CWE-117) by sanitizing log messages. It ensures that newline characters and other control characters are properly escaped or removed, mitigating the risk of log forging attacks. The current version is 1.2.1, and it maintains a focused feature set with stable, infrequent releases.

pip install logging-formatter-anticrlf
INSTALL
IMPORT
SIG · LOGGING-FORMATTER-
L
logging-formatter-anticrlf
observabilitypythonv1.2.1
Install
1.5s avg
Import
Disk
16MB
Pass rate
10/ 10
Env Coverage10 / 10
glibc
3.93.13
musl
3.93.13
Install & Compatibility
Where this runs
tested against v1.2.1 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.103.910 runs
installs and imports cleanly · install 0.0s · import 0.000s · 17.8MB
glibc
py 3.103.910 runs
installs and imports cleanly · install 1.5s · import 0.000s · 18MB
16MB installed
● package 16MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

LogFormatter
from anticrlf import LogFormatter
from logging_formatter_anticrlf import AntiCRLFFormatter

This quickstart demonstrates how to integrate `AntiCRLFFormatter` into a standard Python logging setup. It shows how to instantiate the formatter and apply it to a `StreamHandler` to sanitize log messages before they are written to the console, preventing CRLF injection.

import logging import sys from logging_formatter_anticrlf import AntiCRLFFormatter # Configure the logger logger = logging.getLogger(__name__) logger.setLevel(logging.INFO) # Create a console handler handler = logging.StreamHandler(sys.stdout) handler.setLevel(logging.INFO) # Create an AntiCRLFFormatter and set it on the handler # The formatter will sanitize the message before output formatter = AntiCRLFFormatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s') handler.setFormatter(formatter) # Add the handler to the logger logger.addHandler(handler) # Test messages with potential CRLF injection logger.info("This is a safe log message.") logger.info("User input: %s", "username%0D%0Aevil_injection") logger.warning("Another line for a multi-line attack: %s", "value\nmalicious") # Expected output: Newlines and carriage returns will be replaced or escaped in the output.
Debug
Known issues
gotchaThe `AntiCRLFFormatter` primarily sanitizes the `message` field (and its arguments) that are processed by the formatter. If sensitive user input is directly included in other log record attributes (e.g., via the `extra` dict for custom fields) and those attributes are formatted directly by handlers or custom formatters, CRLF injection might still be possible.
fix
Always pass potentially untrusted input via the message argument and its formatting arguments (e.g., `logger.info('User: %s', user_input)`). Ensure any custom formatters or handlers explicitly sanitize other log record attributes if they contain untrusted data.
affects: All versions
gotchaThis formatter addresses CRLF injection on the *output* of log messages to a handler. It does not prevent other forms of log manipulation if the underlying logging system or storage mechanism is compromised, or if inputs are not properly validated *before* reaching the logger (e.g., if a database field storing log data already contains malicious content).
fix
Combine `AntiCRLFFormatter` with a comprehensive security strategy, including robust input validation, secure system configurations, and appropriate access controls for log files and logging infrastructure.
affects: All versions
Upgrade
Version history
1.2.1latest on PyPI · released Sep 28, 2023
Audit
Dependencies

No dependency data recorded yet.

Agent activity
11 hits · last 30 days
node
10
OpenAI (training)
1
Resources
logging-formatter-anticrlf — pip install logging-formatter-anticrlf · libregistry