Seguridad · plugin para JetBrains
Log Injection Companion
GratisLog Injection Detection
Flags an unsanitized logging call reachable from an HTTP endpoint parameter, anywhere in the project's real call graph.
La brecha que resuelve
CWE-117 (Log Injection): an attacker injects a CRLF sequence to forge fake log entries. SEI CERT IDS03-J ("Do not log unsanitized user input"). AWS CodeGuru Reviewer has a dedicated detector -- CI/batch, not an inline IDE inspection. Qodana's own taint analysis covers OWASP A01/A03/A07/A08/A10 -- A09 (Security Logging and Monitoring Failures, which Log Injection falls under) is confirmed NOT among them, and Qodana taint analysis requires a paid Ultimate Plus license regardless (not Community Edition). No dedicated Marketplace plugin found.
Datos y precio
- Categoría
- Seguridad
- Precio
- Gratis
- Plataforma
- IntelliJ-family
- Primera publicación
- —
- ID en Marketplace
- #34068
- Repositorio
log-injection-companion- Crecimiento
- ▲ +900.0% desde el 2026-09-05 (3→30)
Plugins relacionados
Todos los plugins de seguridadLightweight, 100% local API-security checks for Java and Kotlin: hardcoded secrets, plaintext HTTP, TLS misconfiguration, and OWASP API Security Top 10 patterns.
Decode and verify JSON Web Tokens directly in a dedicated tool window: no browser round-trip, no data leaving the IDE.
A native, client-side viewer for X.509 certificates and keystores: decode a .pem, .crt, .cer, .der, .jks, .p12, or .pfx file without leaving the IDE.
Flags known-vulnerable dependency versions directly in pom.xml, build.gradle(.kts), package.json, and requirements.txt, matched against a vulnerability database bundled inside the plugin: zero account, zero token, zero network call, ever.
Descargas y estrellas al 2026-10-18, actualizadas dos veces al día desde las API de JetBrains Marketplace y GitHub.