Prevent Log Injection in Log4j2: Clean Input, PatternLayout, and Custom Throwable Converter

A new system's login module logs every attempt; an attacker supplies a username containing a newline, bypassing whitelist validation and causing log injection that leads to false account bans.

Simple remediation: replace newline characters in log parameters before logging.

public static String getCleanedMsg(String message) {
    if (message == null) {
        return "";
    }
    message = message.replace('
', '_').replace('\r', '_');
    return message;
}
LOGGER.warn("username is wrong,userName={}", getCleanedMsg(userName));

When many legacy log statements exist, leverage Log4j2's built‑in encoding to automatically filter CR/LF characters.

<Console name="Console" target="SYSTEM_OUT">
    <PatternLayout pattern="[%d{yyyy-MM-dd HH:mm:ss.SSS}][%-5p] [%t] [%c{10}#%M:%L] %enc{%m}{CRLF} %n " />
</Console>

For exception stack traces, create a custom ThrowablePatternConverter that encodes newline characters in the exception message.

@Plugin(name = "UndefineThrowablePatternConverter", category = PatternConverter.CATEGORY)
@ConverterKeys({"uEx"})
public class UndefineThrowablePatternConverter extends ThrowablePatternConverter {
    static class EncodeThrowableProxy extends ThrowableProxy {
        public EncodeThrowableProxy(Throwable throwable) { super(throwable); }
        @Override
        public String getMessage() {
            return super.getMessage().replaceAll("\r", "\\r").replaceAll("
", "\
");
        }
    }
    protected UndefineThrowablePatternConverter(Configuration config, String[] options) {
        super("UndefineThrowable", "throwable", options, config);
    }
    public static UndefineThrowablePatternConverter newInstance(final Configuration config, final String[] options) {
        return new UndefineThrowablePatternConverter(config, options);
    }
    @Override
    public void format(final LogEvent event, final StringBuilder toAppendTo) {
        Throwable throwable = event.getThrown();
        if (throwable == null) return;
        EncodeThrowableProxy proxy = new EncodeThrowableProxy(throwable);
        proxy.formatExtendedStackTraceTo(toAppendTo, options.getIgnorePackages(),
            options.getTextRenderer(), getSuffix(event), options.getSeparator());
    }
}

Adding %uEx to the layout activates this converter, ensuring exception messages are also protected from injection.

Key takeaways: Whitelist validation cannot prevent log injection when error inputs are logged; use Log4j2's encoding features ( %enc{%m}{CRLF}) to handle all parameters centrally; also sanitize exception messages with a custom converter to eliminate injection risks.