Rule Definition
Writing unvalidated, unsanitized user input to log files can allow an attacker to forge log entries or inject malicious content into the logs. Applications typically use log files to store a history of events or transactions for later review, statistics gathering, or debugging. Depending on the nature of the application, the task of reviewing log files may be performed manually or sometimes automated with a tool that automatically gathers log data for important events or trending information. Interpretation of the log files may be hindered or misdirected if an attacker can supply data to the application that is subsequently logged verbatim.

Remediation
Code the appropriate input validation as close as possible to the user input call.

Violation Code Sample

String val = request.getParameter("value");
try {
    int value = Integer.parseInt(value);
}
catch (NumberFormatException) {
    log.info("Failed to parse value = " + value);
}

Fixed Code Sample

String val = request.getParameter("value");
try {
    int value = Integer.parseInt(value);
}
catch (NumberFormatException) {
    String sanitizedValue = ... // Sanitize here the value
    log.info("Failed to parse value = " + sanitizedValue);
}

http://cwe.mitre.org/data/definitions/117.html