java - Can't resolve Log Forging Fortify issue -

-

i having trouble fixing log forging issue in fortify. issue, "writes unvalidated user input log", being raised both of logging calls in getlongfromtimestamp() method.

public long getlongfromtimestamp(final string value) {     logger.info("getlongfromtimestamp(" + cleanlogstring(value) + ")");      long longval = 0;     date tempdate = null;     try {                     tempdate = new simpledateformat(format_yyyymmddhhmmss, locale.us).parse(value);     } catch (parseexception e) {         logger.warn("failed convert date: " + cleanlogstring(value) + " exception: " + cleanlogstring(e.getmessage()));         throw new exception(e);     }      if (tempdate != null) {         longval = tempdate.gettime();     }     return longval; }  private cleanlogstring(string logstring) {     string clean = logstring.replaceall("[^a-za-z0-9]", "");      if(!logstring.equals(clean)) {         clean += " (cleaned)";     }      return clean; }

the cleanlogstring() method has fixed other log forging fortify issues in project, has no effect on 2 above.

any appreciated!

i know have run situations complexity of application stop malicious input working intended; fortify not consider secure. bet running same thing.

you stripping useful characters out of log message, see happens if encoding on output prior writing log.

http://www.jtmelton.com/2010/09/21/preventing-log-forging-in-java/

// ensure no crlf injection logs forging records string clean = message.replace( '\n', '_' ).replace( '\r', '_' ); if ( esapi.securityconfiguration().getlogencodingrequired() ) {     clean = esapi.encoder().encodeforhtml(message);     if (!message.equals(clean)) {         clean += " (encoded)";     } }

Comments

Post a Comment

Popular posts from this blog

Java 3D LWJGL collision -

-
i making 3d java game lwjgl library, , wondering how add collision detection, player not go through models. i using obj models. here objloader class, loads models: package renderengine; import java.io.bufferedreader; import java.io.file; import java.io.filenotfoundexception; import java.io.filereader; import java.util.arraylist; import java.util.list; import models.rawmodel; import org.lwjgl.util.vector.vector2f; import org.lwjgl.util.vector.vector3f; public class objloader { public static rawmodel loadobjmodel(string filename, loader loader){ filereader fr = null; try { fr = new filereader(new file("res/"+filename+".obj")); } catch (filenotfoundexception e) { system.err.println("couldn't load file!"); e.printstacktrace(); } bufferedreader reader = new bufferedreader(fr); string line; list<vector3f> vertices = new arraylist<vector3f...
Read more

spring - SubProtocolWebSocketHandler - No handlers -

-
i have ugly error during deploying spring app on jboss. 18:11:16,025 error [org.apache.catalina.core.containerbase.[jboss.web].[default-host].[/consumer]] (msc service thread 1-7) exception sending context initialized event listener instance of class org.springframework.web.context.contextloaderlistener: org.springframework.context.applicationcontextexception: failed start bean 'subprotocolwebsockethandler'; nested exception java.lang.illegalargumentexception: no handlers @ org.springframework.context.support.defaultlifecycleprocessor.dostart(defaultlifecycleprocessor.java:176) [spring-context-4.1.3.release.jar:4.1.3.release] @ org.springframework.context.support.defaultlifecycleprocessor.access$200(defaultlifecycleprocessor.java:51) [spring-context-4.1.3.release.jar:4.1.3.release] @ org.springframework.context.support.defaultlifecycleprocessor$lifecyclegroup.start(defaultlifecycleprocessor.java:346) [spring-context-4.1.3.release.jar:4.1.3.release] @ org.s...
Read more

methods - python can't use function in submodule -

-
my folder structure this: pythonstuff/ program.py modulea/ __init__.py foo.py bar.py here's code bar.py : def hello(): print("hello, world!") here's code program.py : #!/usr/bin/env python3 modulea import bar bar.hello() i run $ python3 program.py somehow error: file "program.py", line 3, in <module> bar.hello() attributeerror: 'module' object has no attribute 'hello' edit: __init__.py file empty. edit2: after trying realized had bar.py in root directory contained hello() method. bar.py in modulea/ directory empty. add it import os __all__ = [] module in os.listdir(os.path.dirname(__file__)): if module != '__init__.py' , module[-3:] == '.py': __all__.append(module[:-3]) the init .py files required make python treat directories containing packages; done prevent directories common name, such string, unintentionally hiding v...
Read more