메뉴
Generate secure log entry generation code. Enforces secure generation of code generating a log entry. Invoke when writing any log entry generation related code.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Generate secure code for HTTP request preventing exposure to DNS rebinding attack. Enforces HTTP request not exposed to DNS rebinding attack. Invoke when writing HTTP request code that must only target public IP addresses.
Generate secure microsoft excel file validation code. Enforces secure generation of code validating a microsoft excel file. Invoke when writing any microsoft excel file validation related code.
Generate secure microsoft word file validation code. Enforces secure generation of code validating a microsoft word file. Invoke when writing any microsoft word file validation related code. See "security-considerations" metadata for security limitations.
Generate secure relative url validation code for open redirect prevention. Enforces secure generation of code validating a relative url. Invoke when writing any relative url validation related code. See "security-considerations" metadata for strict validation behavior.
Generate secure pdf file validation code. Enforces secure generation of code validating a pdf file. Invoke when writing any pdf file validation related code.
Generate secure Comma Separated Values (CSV) generation code. Enforces secure generation of Comma Separated Values (CSV) content. Invoke when writing any Comma Separated Values (CSV) generation related code.
| name | secure-log-entry-generation |
| description | Generate secure log entry generation code. Enforces secure generation of code generating a log entry. Invoke when writing any log entry generation related code. |
| allowed-tools | Read Grep Glob |
| metadata | {"category":"security"} |
Apply all rules below when generating or reviewing any code related to generation of a log entry.
\r, \n, \u2028 (Unicode LINE SEPARATOR) or \u2029 (Unicode PARAGRAPH SEPARATOR) character in the value is removed.// BAD: No validation is applied
void handleRequest(HttpServletRequest request) {
String userControlledContent = request.getParameter("input");
Logger logger = Logger.getLogger(Main.class.getName());
logger.info(userControlledContent);
}
// GOOD: All points are applied
public class LogHelper {
private static final int MAX_USER_INPUT_LENGTH = 100;
private static String sanitize(String value) {
if (value == null) return "null";
// Rule 1: HTML-encode special characters (prevent markup injection)
value = value.replace("&", "&")
.replace("<", "<")
.replace(">", ">")
.replace("\"", """)
.replace("'", "'");
// Rule 2: Remove line-break characters (prevent log forging)
value = value.replace("\r", "")
.replace("\n", "")
.replace("\u2028", "") // Unicode LINE SEPARATOR
.replace("\u2029", ""); // Unicode PARAGRAPH SEPARATOR
// Rule 3: Remove ANSI escape sequences (prevent terminal escape injection)
value = value.replaceAll("\u001B\\[[\\d;]*[a-zA-Z]", "") // strip CSI sequences
.replace("\u001B", ""); // strip bare ESC
// Rule 4: Truncate to maximum allowed length (prevent log flooding)
if (value.length() > MAX_USER_INPUT_LENGTH) {
value = value.substring(0, MAX_USER_INPUT_LENGTH) + "[TRUNCATED]";
}
return value;
}
public static void logUserInput(String userControlledContent) {
Logger logger = Logger.getLogger(LogHelper.class.getName());
logger.info(sanitize(userControlledContent));
}
}
Before finalizing generated code, verify:
\r, \n, \u2028 or \u2029 character is removed.