القائمة
Generate secure log entry generation code. Enforces secure generation of code generating a log entry. Invoke when writing any log entry generation related code.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Generate secure code for HTTP request preventing exposure to DNS rebinding attack. Enforces HTTP request not exposed to DNS rebinding attack. Invoke when writing HTTP request code that must only target public IP addresses.
Generate secure microsoft excel file validation code. Enforces secure generation of code validating a microsoft excel file. Invoke when writing any microsoft excel file validation related code.
Generate secure microsoft word file validation code. Enforces secure generation of code validating a microsoft word file. Invoke when writing any microsoft word file validation related code. See "security-considerations" metadata for security limitations.
Generate secure relative url validation code for open redirect prevention. Enforces secure generation of code validating a relative url. Invoke when writing any relative url validation related code. See "security-considerations" metadata for strict validation behavior.
Generate secure pdf file validation code. Enforces secure generation of code validating a pdf file. Invoke when writing any pdf file validation related code.
Generate secure Comma Separated Values (CSV) generation code. Enforces secure generation of Comma Separated Values (CSV) content. Invoke when writing any Comma Separated Values (CSV) generation related code.
| name | secure-log-entry-generation |
| description | Generate secure log entry generation code. Enforces secure generation of code generating a log entry. Invoke when writing any log entry generation related code. |
| allowed-tools | Read Grep Glob |
| metadata | {"category":"security"} |
Apply all rules below when generating or reviewing any code related to generation of a log entry.
\r, \n, \u2028 (Unicode LINE SEPARATOR) or \u2029 (Unicode PARAGRAPH SEPARATOR) character in the value is removed.// BAD: No validation is applied
void handleRequest(HttpServletRequest request) {
String userControlledContent = request.getParameter("input");
Logger logger = Logger.getLogger(Main.class.getName());
logger.info(userControlledContent);
}
// GOOD: All points are applied
public class LogHelper {
private static final int MAX_USER_INPUT_LENGTH = 100;
private static String sanitize(String value) {
if (value == null) return "null";
// Rule 1: HTML-encode special characters (prevent markup injection)
value = value.replace("&", "&")
.replace("<", "<")
.replace(">", ">")
.replace("\"", """)
.replace("'", "'");
// Rule 2: Remove line-break characters (prevent log forging)
value = value.replace("\r", "")
.replace("\n", "")
.replace("\u2028", "") // Unicode LINE SEPARATOR
.replace("\u2029", ""); // Unicode PARAGRAPH SEPARATOR
// Rule 3: Remove ANSI escape sequences (prevent terminal escape injection)
value = value.replaceAll("\u001B\\[[\\d;]*[a-zA-Z]", "") // strip CSI sequences
.replace("\u001B", ""); // strip bare ESC
// Rule 4: Truncate to maximum allowed length (prevent log flooding)
if (value.length() > MAX_USER_INPUT_LENGTH) {
value = value.substring(0, MAX_USER_INPUT_LENGTH) + "[TRUNCATED]";
}
return value;
}
public static void logUserInput(String userControlledContent) {
Logger logger = Logger.getLogger(LogHelper.class.getName());
logger.info(sanitize(userControlledContent));
}
}
Before finalizing generated code, verify:
\r, \n, \u2028 or \u2029 character is removed.