Log injection
User-provided inputs must be sanitized before they are logged. An attacker can use unsanitized input to break a log's integrity, forge log entries, or bypass log monitors.
def logging_noncompliant():
    filename = input("Enter a filename: ")
    # Noncompliant: unsanitized input is logged.
    logger.info("Processing %s", filename)
def logging_compliant():
    filename = input("Enter a filename: ")
    if filename.isalnum():
        # Compliant: input is validated before logging.
        logger.info("Processing %s", filename)