...
| Code Block | ||
|---|---|---|
| ||
public class ExceptionLog {
private static String logMessage;
private static Logger theLogger =
Logger.getLogger("ExceptionLog.class.getName()");
public static void main(String[] args) {
ExceptionLog log = new ExceptionLog();
FileWriter fw=null;
BufferedWriter bw=null;
try {
fw = new FileWriter("log_file.txt"); //this can throw an exception, but security exception is still logged
bw = new BufferedWriter(fw);
}catch (FileNotFoundException fne){ logMessage("File Not Found Exception!"); }
catch (IOException e) { logMessage("IO Exception!"); }
//some security exception occurs here
log.logMessage("Security Exception has occurred!");
log.writeLog(bw);
}
public static void logMessage(String message) {
logMessage = message;
}
public void writeLog(BufferedWriter bw) {
// use the 'least important' type of message, one at
// the 'finest' level.
theLogger.info("Starting to log");
System.err.println(logMessage);
//write to a file can miss writing the original security exception
}
}
|
Risk Assessment
TODOIf an exception is thrown while data is being logged then data may be lost or problems may be concealed.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
FIO03-J | ?? low ?? | unlikely | ?? high | P?? | L?? |
Automated Detection
...
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
NoneTODO