logging-formatter-anticrlf

What it is and what it does

logging-formatter-anticrlf is a security-focused logging formatter that prevents CRLF injection attacks by escaping carriage returns (\r) and linefeeds (\n) in log messages. It wraps Python's standard logging.Formatter with identical construction arguments, so it works as a drop-in replacement in existing logging configurations. By default, CR and LF characters are replaced with their escaped equivalents (\r and \n), preventing attackers from injecting fake log entries or manipulating log output when logs are displayed in browsers or parsed by downstream tools.

The package includes a SubstitutionMap object that manages replacements with built-in safety checks: it prevents you from replacing unsafe characters with other unsafe characters, and it resets to safe defaults if you accidentally assign an unsafe configuration. This design protects against common mistakes where a developer might inadvertently weaken the sanitization. The package addresses CWE-93 (log injection) and CRLF-based forms of CWE-117 (improper output neutralization), though it does not handle all CWE-117 variants such as XSS flaws in browser-rendered logs.

Use it for:

• Secure web applications that log user input or request data to prevent attackers from injecting fake log entries or log forging.
• Systems where logs are aggregated, parsed, or displayed in tools that interpret CR/LF as structural delimiters.
• Compliance-focused projects that need to demonstrate log integrity and prevent log tampering via injection.
• Applications handling untrusted input (API requests, form submissions) that must sanitize before logging.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

A drop-in replacement for Python's standard logging.Formatter that escapes carriage returns and linefeeds in log output to prevent CRLF injection attacks (CWE-93 and CWE-117).

Yes, if you log untrusted user input or need to prevent log injection attacks. The package is low-friction (no dependencies), permissively licensed, and has no known vulnerabilities. Maintenance is dormant but the code is stable and the attack surface is minimal. Install it as a standard practice in security-conscious logging setups; the one-line formatter swap makes adoption trivial.

Install

logging-formatter-anticrlf on PyPI

pip install logging-formatter-anticrlf

uv add logging-formatter-anticrlf

poetry add logging-formatter-anticrlf

Installing logging-formatter-anticrlf

Before you install

Low friction: pure Python wheel with no runtime dependencies. Maintenance is dormant (last commit 2024-02-23, 1051 days since release), but the package is archived=false and has no known vulnerabilities, suggesting it is stable rather than abandoned.

License in practice

BSD-2-clause is permissive and imposes minimal restrictions on use or redistribution, making it suitable for most projects without licensing concerns.

Quickstart

import logging
import anticrlf

handler = logging.StreamHandler()
handler.setFormatter(anticrlf.LogFormatter('%(levelname)s - %(message)s'))
logger = logging.getLogger(__name__)
logger.addHandler(handler)
logger.info("Text with newline\nhere")  # outputs escaped as \n, not a line break

Verify before relying

• Whether the package is actively maintained or if dormant status reflects intentional stability rather than abandonment.
• Whether Python version support is truly unspecified or if there are practical constraints not documented in the fact sheet.

Package facts

Evidence: logging_formatter_anticrlf-1.2.1-py3-none-any.whl

Tags

More Security packages