Method to neutralize data recorded in logs?

[katyanton]

Some libraries (like log4j2) have protections agains log forging and XSS which can be enabled via config settings.
Other libraries (log4j v1 and other ) don't have this option.

Can any of the existing OWASP Java Encoder functions be used to neutralize data recorded in logs ?
If not, is it possible to have a new method, let's say encode#ForLogs(), that will take care of both HTMLEncode and log forging?

Thanks,
Katy

[jmanico]

Katy, A *separate* log encoder function to stop log injection is a reasonable idea. Pertinent characters that would need to be managed are listed here. https://affinity-it-security.com/how-to-prevent-log-injection/ A few concerns... 1) There really is no "log escaping format". Most log injection protections just remove the dangerous characters or replace them with a space or something else innocent. 2) Another though is that this library is pretty strictly for just XSS defense. I'm not sure if the author wants to expand the library for other types of injection. What do you think, Dr. Jeff? Aloha, Jim

…

On 3/19/18 6:47 AM, katyanton wrote: Some libraries (like log4j2) have protections agains log forging and XSS which can be enabled via config settings. Other libraries (log4j v1 and other ) don't have this option. Can any of the existing OWASP Java Encoder functions be used to neutralize data recorded in logs ? If not, is it possible to have another method, let's say encodeForLogs(), that will take care of both HTMLEncode and log forging? Thanks, Katy — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#11>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAgcCcmrVlKQnA3i4gmBvtJdJA2WBLthks5tf-EvgaJpZM4Swg53>.

-- Jim Manico Manicode Security https://www.manicode.com

[jeremylong]

Consider logging to a structured format such as JSON - then standard JSON encoding would be sufficient. Logging to JSON is often a good choice.

[augustd]

Hi @katyanton, The OWASP Security Logging Project includes an encoder for Logback, but for Log4J we recommend using the built-in encoder:

https://github.com/javabeanz/owasp-security-logging/wiki/Log-Forging

[katyanton]

Hi @augustd - I'm aware of the encoding for Log4J, but this is available only in version 2, not version 1.

[jmanico]

👍🏼👍🏼

…

-- Jim Manico @manicode Secure Coding Education +1 (808) 652-3805

On Mar 20, 2018, at 7:18 AM, August Detlefsen ***@***.***> wrote: Hi @katyanton, The OWASP Security Logging Project includes an encoder for Logback, but for Log4J we recommend using the built-in encoder: https://github.com/javabeanz/owasp-security-logging/wiki/Log-Forging — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

[katyanton]

Hi @jeremylong - I hear what you're saying and makes sense.
The corresponding method in OWASP Encoder would be encode#forJavaScriptSource(String) .
It would be a bit counter intuitive for a developer to know to use that method though.

[augustd]

Unfortunately Log4J version 1 is somewhat lacking in the extensibility department (most of the classes are actually final). Is that a hard requirement? Ideally you should be moving towards Log4J2 -you will get many more features and better performance. Otherwise feel free to submit a feature request at OWASP Security Logging and we can look into adding an encoder for version 1.

For ESAPI I actually created a whole wrapper for the Log4JLogger which does the encoding, but then you have to use ESAPI's API, not Log4J's.

[xeno6696]

Log4j v1's days in ESAPI are also numbered. We've been having an on-again off-again conversation about what to do with ESAPI's logger.

…

On Tue, Mar 20, 2018 at 1:22 PM August Detlefsen ***@***.***> wrote: Unfortunately Log4J version 1 is somewhat lacking in the *extensibility* department (most of the classes are actually final). Is that a hard requirement? Ideally you should be moving towards Log4J2 -you will get many more features and better performance. Otherwise feel free to submit a feature request at OWASP Security Logging and we can look into adding an encoder for version 1. For ESAPI I actually created a whole wrapper for the Log4JLogger <https://github.com/ESAPI/esapi-java-legacy/blob/develop/src/main/java/org/owasp/esapi/reference/Log4JLogger.java#L412> which does the encoding, but then you have to use ESAPI's API, not Log4J's. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#11 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AJEAQXNJMSaPYlNUUMhYy4jsqSaJsSVDks5tgWUggaJpZM4Swg53> .

[jmanico]

We politely do not think this library is the right place for logging functions. Please consider the OWASP Logging project for this request!