Sanitize user-controlled values before they reach log messages
Logger calls in pino, winston, bunyan, and consola should not interpolate or concatenate request input directly into the message text.
#Metadata
#Why it matters
Unsanitized request data in log messages enables CRLF injection, control-character smuggling, and downstream log-parser confusion. Wrapping the value with a structured field, JSON encoder, or CRLF-stripping replace neutralizes the vector.
#Remediation
Pass request data as a structured field, JSON-encode it, or strip CRLF and control characters before concatenating it into the log message.
#Repository path
The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.log-injection.rule.yaml.