{"categories":[{"label":"Security","url":"https://skillfed.io/packages/category/security/2"}],"enrichment":{"capability":"A drop-in replacement for Python's standard logging.Formatter that escapes carriage returns and linefeeds in log output to prevent CRLF injection attacks (CWE-93 and CWE-117).","skillfed_tags":["log-security","cwe-prevention","injection-defense"],"use_cases":["Secure web applications that log user input or request data to prevent attackers from injecting fake log entries or log forging.","Systems where logs are aggregated, parsed, or displayed in tools that interpret CR/LF as structural delimiters.","Compliance-focused projects that need to demonstrate log integrity and prevent log tampering via injection.","Applications handling untrusted input (API requests, form submissions) that must sanitize before logging."],"what_it_does":"logging-formatter-anticrlf is a security-focused logging formatter that prevents CRLF injection attacks by escaping carriage returns (\\r) and linefeeds (\\n) in log messages. It wraps Python's standard logging.Formatter with identical construction arguments, so it works as a drop-in replacement in existing logging configurations. By default, CR and LF characters are replaced with their escaped equivalents (\\r and \\n), preventing attackers from injecting fake log entries or manipulating log output when logs are displayed in browsers or parsed by downstream tools.\n\nThe package includes a SubstitutionMap object that manages replacements with built-in safety checks: it prevents you from replacing unsafe characters with other unsafe characters, and it resets to safe defaults if you accidentally assign an unsafe configuration. This design protects against common mistakes where a developer might inadvertently weaken the sanitization. The package addresses CWE-93 (log injection) and CRLF-based forms of CWE-117 (improper output neutralization), though it does not handle all CWE-117 variants such as XSS flaws in browser-rendered logs.","worth_installing":"Yes, if you log untrusted user input or need to prevent log injection attacks. The package is low-friction (no dependencies), permissively licensed, and has no known vulnerabilities. Maintenance is dormant but the code is stable and the attack surface is minimal. Install it as a standard practice in security-conscious logging setups; the one-line formatter swap makes adoption trivial."},"id":"logging-formatter-anticrlf","links":{"html":"https://skillfed.io/packages/logging-formatter-anticrlf","md":"https://skillfed.io/packages/logging-formatter-anticrlf.md","pypi":"https://pypi.org/project/logging-formatter-anticrlf/"},"maintenance":{"status":"dormant"},"meta":{"latest_release":"2023-09-28","license_spdx":null,"license_treatment":"permissive","name":"logging-formatter-anticrlf","python_support":"unspecified","summary":"Python logging Formatter for CRLF Injection (CWE-93 / CWE-117) prevention"},"popularity":{"monthly_downloads":185546,"position":10008,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"1.2.1"}