...
| Code Block | ||
|---|---|---|
| ||
public String sanitizeUser(String username) {
return Pattern.matches("[A-Za-z0-9_]+", username))
? username : "unauthorized user";
} |
...
Allowing unvalidated user input to be logged can result in forging of log entries, leaking secure information, or storing sensitive data in a manner that violates a local law or regulation.
Rule | Severity | Likelihood | Detectable | Remediation CostRepairable | Priority | Level |
|---|---|---|---|---|---|---|
IDS03-J | Medium | Probable | No | NoMedium | P8P4 | L2L3 |
Automated Detection
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| The Checker Framework |
| Tainting Checker | Trust and security errors (see Chapter 8) | ||||||
| CodeSonar |
| JAVA.IO.TAINT.LOG | Tainted Log (Java)log | ||||||
| Fortify | Log_Forging | Implemented | |||||||
| Klocwork |
| SVLOG_FORGING | Implemented | ||||||
| Parasoft Jtest |
| CERT.IDS03.TDLOG | Protect against log forging |
...
[API 2006] | Java Platform, Standard Edition 6 API Specification |
| [Seacord 2015] |
...