6

Can anyone suggest the proper sanitization/validation process required for the courseType variable in the following getCourses method. I am using that variable to write in a log file.

I've tried HtmlUtils.HtmlEscape() but didn't get expected results.

Thanks!

@RequestMapping(value = "/retriveCourses", method = RequestMethod.GET)
@ResponseBody
public List<Course> getCourses(@RequestParam(value = "courseType", required = false) String courseType) {

}
securecodeninja
  • 2,497
  • 3
  • 16
  • 22
NPS
  • 71
  • 1
  • 2
  • 6
  • Can you add the part of the code where you write to the log? – yaloner Mar 27 '19 at 16:05
  • Hi..thanks for the reply. I am writing the @RequestParam to the log as follows -logger.info("Course Type is "+HtmlUtils.HtmlEscape(courseType)). This enabling log forging. – NPS Mar 28 '19 at 04:21

2 Answers2

6

it seems like the Checkmarx tool is correct in this case.

A "Log Forging" vulnerability means that an attacker could engineer logs of security-sensitive actions and lay a false audit trail, potentially implicating an innocent user or hiding an incident.

While using htmlEscape will escape some special characters:

  • &amplt; represents the < sign.
  • &ampgt; represents the > sign.
  • &ampamp; represents the & sign.
  • &ampquot; represents the " mark.

It will not escape or remove new-line/EOL/tab characters that must be avoided in order to keep logs integrity.

The best practice recommendations to avoid log forging are:

  1. Make sure to replace all relevant dangerous characters. example:

    cleanInput = input.replace('\t', '-').replace('\n', '-').replace('\r', '-');

  2. Validate all input, regardless of source. Validation should be based on a whitelist. Accept only data fitting a specified structure, rather than reject bad patterns. Check for: Data type, Size, Range, Format, Expected values.

Hopefully, that solves your problem.

baruchiro
  • 5,088
  • 5
  • 44
  • 66
yaloner
  • 715
  • 2
  • 6
  • 19
6

  1. Have a look at the Logging - OWASP Cheat Sheet Series in the section 'Event Collection'

  2. The best encoder still OWASP Java Encoder => Solve the 2. of @yaloner

  3. There is also a project at OWASP To help you to deal withs log injections OWASP Security Logging => Solve the 1. of @yaloner

Have a look at them will solve the issue

Matt Legler
  • 69
  • 6
SPoint
  • 582
  • 2
  • 10
  • 2
    Direct links to the projects in question: https://github.com/OWASP/owasp-java-encoder/ and https://github.com/javabeanz/owasp-security-logging – seanf Apr 15 '20 at 06:09