Rule Definition
Writing unvalidated, unsanitized user input to log files can allow an attacker to forge log entries or inject malicious content into the logs. Applications typically use log files to store a history of events or transactions for later review, statistics gathering, or debugging. Depending on the nature of the application, the task of reviewing log files may be performed manually or sometimes automated with a tool that automatically gathers log data for important events or trending information. Interpretation of the log files may be hindered or misdirected if an attacker can supply data to the application that is subsequently logged verbatim. Anyway, this should not be a problem as per debug level should not appear in production.

Remediation
Use authorized sanitization methods.

Violation Code Sample

String login = request.getParameter("login");
log.debug("Login=" + login);

Fixed Code Sample

String login = request.getParameter("login");
log.debug("Login=" + ESAPI.encoder().encodeForHTML(login));

CWE-117: Improper Output Neutralization for Logs https://cwe.mitre.org/data/definitions/117.html