Can anyone suggest the proper sanitization/validation process required for the courseType variable in the following getCourses method. I am using that variable to write in a log file.
I’ve tried HtmlUtils.HtmlEscape() but didn’t get expected results.
Thanks!
@RequestMapping(value = "/retriveCourses", method = RequestMethod.GET)
@ResponseBody
public List<Course> getCourses(@RequestParam(value = "courseType", required = false) String courseType) {
}
Advertisement
Answer
it seems like the Checkmarx tool is correct in this case.
A “Log Forging” vulnerability means that an attacker could engineer logs of security-sensitive actions and lay a false audit trail, potentially implicating an innocent user or hiding an incident.
While using htmlEscape will escape some special characters:
&lt;represents the<sign.&gt;represents the>sign.&amp;represents the&sign.&quot;represents the"mark.
It will not escape or remove new-line/EOL/tab characters that must be avoided in order to keep logs integrity.
The best practice recommendations to avoid log forging are:
Make sure to replace all relevant dangerous characters. example:
cleanInput = input.replace('t', '-').replace('n', '-').replace('r', '-');Validate all input, regardless of source. Validation should be based on a whitelist. Accept only data fitting a specified structure, rather than reject bad patterns. Check for: Data type, Size, Range, Format, Expected values.
Hopefully, that solves your problem.