Registry /
observability / logging-formatter-anticrlf
logging-formatter-anticrlf is a Python logging Formatter designed to prevent CRLF Injection (CWE-93 / CWE-117) by sanitizing log messages. It ensures that newline characters and other control characters are properly escaped or removed, mitigating the risk of log forging attacks. The current version is 1.2.1, and it maintains a focused feature set with stable, infrequent releases.
Install & Compatibility
Where this runs
tested against v1.2.1 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.910 runs
installs and imports cleanly · install 0.0s · import 0.000s · 17.8MB
glibcpy 3.10–3.910 runs
installs and imports cleanly · install 1.5s · import 0.000s · 18MB
16MB installed
● package 16MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
from anticrlf import LogFormatter
This quickstart demonstrates how to integrate `AntiCRLFFormatter` into a standard Python logging setup. It shows how to instantiate the formatter and apply it to a `StreamHandler` to sanitize log messages before they are written to the console, preventing CRLF injection.
import logging
import sys
from logging_formatter_anticrlf import AntiCRLFFormatter
# Configure the logger
logger = logging.getLogger(__name__)
logger.setLevel(logging.INFO)
# Create a console handler
handler = logging.StreamHandler(sys.stdout)
handler.setLevel(logging.INFO)
# Create an AntiCRLFFormatter and set it on the handler
# The formatter will sanitize the message before output
formatter = AntiCRLFFormatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s')
handler.setFormatter(formatter)
# Add the handler to the logger
logger.addHandler(handler)
# Test messages with potential CRLF injection
logger.info("This is a safe log message.")
logger.info("User input: %s", "username%0D%0Aevil_injection")
logger.warning("Another line for a multi-line attack: %s", "value\nmalicious")
# Expected output: Newlines and carriage returns will be replaced or escaped in the output.
Upgrade
Version history
Breaking-change detection hasn't run for this library yet.
Audit
Security & dependencies
CVE tracking and dependency tree are planned for a later release.