Why is this an issue?

In software development, logs serve as a record of events within an application, providing crucial insights for debugging. When logging, it is essential to ensure that the logs are:

• easily accessible
• uniformly formatted for readability
• properly recorded
• securely logged when dealing with sensitive data

Those requirements are not met if a program directly writes to the standard outputs (e.g., print!, println!). That is why defining and using a dedicated logger is highly recommended.

Code examples

Noncompliant code example

fn do_something() {
    println!("my message");  // Noncompliant, output directly to stdout without a logger
}

Compliant solution

use log::{info, LevelFilter};
use simple_logger::SimpleLogger;

fn do_something() {
    SimpleLogger::new().with_level(LevelFilter::Info).init().unwrap();
    // ...
    info!("my message");  // Compliant, output via logger
    // ...
}

Resources

Documentation

• Clippy Lints - https://rust-lang.github.io/rust-clippy/master/index.html#print_stdout
• OWASP - Top 10 2021 Category A9 - Security Logging and Monitoring Failures
• OWASP - Top 10 2017 Category A3 - Sensitive Data Exposure