如何修复Veracode CWE 117（日志输出中和不当）

Question

Spring global@exceptionHandler(exception.class)方法记录如下异常：

@ExceptionHandler(Exception.class)
void handleException(Exception ex) {
    logger.error("Simple error message", ex);
...

Veracode scan指出，该日志有不正确的日志输出中性化，并建议使用ESAPI日志记录器。有没有什么方法可以在不将记录器更改为ESAPI的情况下修复此漏洞？这是我在代码中唯一面对这个问题的地方，我试图找出如何用最少的更改来修复它。也许ESAPI有一些我没有注意到的方法？

private static final Logger logger = ESAPI.getLogger(MyClass.class);
...
logger.error(null, "Simple error message", ex);

ESAPI有log4j记录器和记录器工厂的扩展。可以在esapi.properties中配置要使用的内容。例如：

ESAPI.Logger=org.owasp.esapi.reference.Log4JLogFactory

Answer 1

有没有什么方法可以在不将记录器更改为ESAPI的情况下修复此漏洞？

简而言之，是的。

TLDR：

log.error( transactionId + " for user " + username + " was unsuccessful."

我还发现确保详细指定日志格式是很有用的...这意味着您要确保对日志语句的外观有严格的标准，并构造格式，以便更容易捕获恶意html" target="_blank">用户。所有程序员必须提交党和遵循格式！

为了防御HTML场景，我将使用[OWASP编码器项目][1]

至于为什么建议使用Esapi的实现，它是一个经过战斗测试的库，但简而言之，这就是我们所做的。请参见代码：

/**
 * Log the message after optionally encoding any special characters that might be dangerous when viewed
 * by an HTML based log viewer. Also encode any carriage returns and line feeds to prevent log
 * injection attacks. This logs all the supplied parameters plus the user ID, user's source IP, a logging
 * specific session ID, and the current date/time.
 *
 * It will only log the message if the current logging level is enabled, otherwise it will
 * discard the message.
 *
 * @param level defines the set of recognized logging levels (TRACE, INFO, DEBUG, WARNING, ERROR, FATAL)
 * @param type the type of the event (SECURITY SUCCESS, SECURITY FAILURE, EVENT SUCCESS, EVENT FAILURE)
 * @param message the message to be logged
 * @param throwable the {@code Throwable} from which to generate an exception stack trace.
 */
private void log(Level level, EventType type, String message, Throwable throwable) {

    // Check to see if we need to log.
    if (!isEnabledFor(level)) {
        return;
    }

    // ensure there's something to log
    if (message == null) {
        message = "";
    }

    // ensure no CRLF injection into logs for forging records
    String clean = message.replace('\n', '_').replace('\r', '_');
    if (ESAPI.securityConfiguration().getLogEncodingRequired()) {
        clean = ESAPI.encoder().encodeForHTML(message);
        if (!message.equals(clean)) {
            clean += " (Encoded)";
        }
    }

    // log server, port, app name, module name -- server:80/app/module
    StringBuilder appInfo = new StringBuilder();
    if (ESAPI.currentRequest() != null && logServerIP) {
        appInfo.append(ESAPI.currentRequest().getLocalAddr()).append(":").append(ESAPI.currentRequest().getLocalPort());
    }
    if (logAppName) {
        appInfo.append("/").append(applicationName);
    }
    appInfo.append("/").append(getName());

    //get the type text if it exists
    String typeInfo = "";
    if (type != null) {
        typeInfo += type + " ";
    }

    // log the message
    // Fix for https://code.google.com/p/owasp-esapi-java/issues/detail?id=268
    // need to pass callerFQCN so the log is not generated as if it were always generated from this wrapper class
    log(Log4JLogger.class.getName(), level, "[" + typeInfo + getUserInfo() + " -> " + appInfo + "] " + clean, throwable);
}

[1]:https://www.owasp.org/index.php/owasp_java_encoder_project并确保输入在进入日志记录语句时进行了正确的编码--与将输入发送回用户时一样。