Log Injection in Chi with Dynamodb

Log injection occurs when an attacker can control or influence log entries, enabling log forging, log spamming, or log injection-based attacks such as log poisoning or log injection via newline characters. In a Chi application that uses Dynamodb as a logging sink, this typically arises when request or application data is written to logs without proper sanitization and then stored in Dynamodb log streams or tables. Because Dynamodb is often used for long-term log retention and querying, injected log content can persist and affect log-based monitoring, alerting, and forensic analysis.

Chi routes and middleware can inadvertently pass attacker-controlled input—such as headers, query parameters, or request bodies—into log statements. When these values contain newline characters (e.g., %0A, %0D) or structured log delimiters, they can split log entries or forge additional log lines. If the logging layer writes these values directly into Dynamodb items (for example, as a message attribute or within a structured JSON field), the forged lines may be interpreted as separate log entries by downstream log consumers. This breaks log integrity and complicates incident response, since the chronological and structural assumptions of log analysis no longer hold.

Additionally, Dynamodb’s schema-less design for log items can amplify the issue: if different services write logs with varying formats, an injected newline in one stream can cause parsers to mis-attribute lines to the wrong request or service. Real-world patterns such as CVE-related log injection techniques—where newline sequences are used to inject fake entries in log aggregation systems—are applicable here. The risk is not that Dynamodb itself is vulnerable, but that the logging pipeline from Chi through to Dynamodb does not enforce strict input validation and output encoding for log fields.

middleBrick scans API endpoints and logs, including scenarios where log injection could affect monitoring and compliance. It checks for missing input validation and unsafe consumption patterns that could allow log injection via newline or structured-data manipulation. This is part of the 12 security checks, including Input Validation and Unsafe Consumption, which help identify whether log data is sanitized before being written to Dynamodb.

Remediation focuses on ensuring that any data destined for Dynamodb log items is sanitized, and that structured logging does not allow newline or control-character injection. In Chi, this means validating and transforming request-scoped values before they reach logging calls, and using safe serialization for Dynamodb attribute values.

First, normalize and sanitize inputs that may be used in logging. For example, strip or replace newline characters before writing to Dynamodb. If you log request headers or user-supplied fields, explicitly remove or encode line breaks and control characters.

;; Chi handler with sanitized logging for Dynamodb
(ns myapp.core
  (:require [cheshire.core :as json]
            [clojure.string :as str]
            [clj-http.client :as http]))

(defn sanitize-log-value [value]
  ;; Remove newline and carriage-return characters to prevent log injection
  (when value
    (-> value
        (str/replace #"\r\n?" " ")
        (str/replace #"\n" " "))))

(defn log-to-dynamodb [item]
  ;; Example: write a sanitized item to Dynamodb
  ;; (pseudo-code for a DynamoDB client call)
  (println (str "Writing to Dynamodb: " (json/generate-string item))))

(defn handler [request]
  (let [user-id (get-in request [:params "user_id"])
        safe-user-id (sanitize-log-value user-id)
        log-item {:timestamp (java.time.Instant/now)
                  :user_id safe-user-id
                  :path (:uri request)
                  :status "ok"}]
    (log-to-dynamodb log-item)
    {:status 200
     :body "ok"}))

Second, prefer structured logging with explicit field definitions and avoid concatenating raw input into log messages that will be stored as Dynamodb attributes. Use maps with known keys and ensure that any string fields are validated for forbidden characters.

;; Safer structured logging approach
(defn build-log-item [request response-time]
  {:request_id (sanitize-log-value (get-in request [:headers "x-request-id"]))
   :client_ip (sanitize-log-value (get-in request [:remote-addr]))
   :method (name (:request-method request))
   :path (sanitize-log-value (:uri request))
   :response_time_ms response-time
   :event "request_completed"
   :timestamp (.toString (java.time.Instant/now))})

Third, when using the middleBrick CLI to scan your Chi endpoints, you can integrate scans into your workflow to detect missing input validation around log-related endpoints. The CLI provides JSON output that highlights findings related to Input Validation and Unsafe Consumption, helping you identify where log injection risks exist. For teams using the Pro plan, continuous monitoring can be configured to alert when new endpoints introduce unsafe logging patterns.

Finally, ensure that any Dynamodb log queries and consumers treat newline characters as invalid in log content. Consumers should not rely on line-based parsing of raw Dynamodb log items; instead, use structured parsing and enforce schema validation. This reduces the impact of any log injection that may occur despite preventive measures.