在CheckMarx 9中显示严重性问题，用于日志锻造
以下是我的代码
private String getCorrelationId(HttpServletRequest request) {
String correlationId = null;
String valuesList = request.getHeader(CORRELATION_ID_HEADER);
String valueLists = StringEscapeUtils.escapeJava(valuesList);
if (valueLists != null && !valueLists.isEmpty()) {
correlationId = valueLists;
}
return correlationId;
}
private void startTransaction(HttpServletRequest request, String serviceName, Object... args) {
String correlationId = getCorrelationId(request);
String correlationIds = StringEscapeUtils.escapeJava(correlationId);
if (correlationIds == null || correlationIds.isEmpty()) {
logger.info(LOG_SERVICE_TYPE + serviceName + args);
} else {
logger.error(LOG_SERVICE_TYPE , serviceName , correlationIds , args);
}
}
收到的错误
方法
getCorrelationId从元素getheader获取用户输入。该元素的值在代码中流过，而不会得到正确的消毒或验证，并最终用于编写startertransaction中的审核日志。 这可能启用 log forging 。
我已经浏览了一些Google链接，但无法理解。任何帮助将不胜感激
This below is my code
private String getCorrelationId(HttpServletRequest request) {
String correlationId = null;
String valuesList = request.getHeader(CORRELATION_ID_HEADER);
String valueLists = StringEscapeUtils.escapeJava(valuesList);
if (valueLists != null && !valueLists.isEmpty()) {
correlationId = valueLists;
}
return correlationId;
}
private void startTransaction(HttpServletRequest request, String serviceName, Object... args) {
String correlationId = getCorrelationId(request);
String correlationIds = StringEscapeUtils.escapeJava(correlationId);
if (correlationIds == null || correlationIds.isEmpty()) {
logger.info(LOG_SERVICE_TYPE + serviceName + args);
} else {
logger.error(LOG_SERVICE_TYPE , serviceName , correlationIds , args);
}
}
Error Received
Method
getCorrelationIdgets user input from elementgetHeader. This element’s value flows through the code without being properly sanitized or validated, and is eventually used in writing an audit log instartTransaction.
This may enable Log Forging.
I have gone through some google links but not able to understand. any help would be appreciated
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
对此很抱歉。
htmlutils.htmlescape- ＆gt;不工作stringscapeutils.escapejava- ＆gt; 无法工作最终
字符串cleanCorrelationId = correlationId.replace（'\ t'，'_'）。替换（'\ n'，'_'）。替换（'\ r'，'_'）;并将“ CleanCorrelationId”放置在日志记录中，
logForging从Checkmarks报告解决的问题。非常感谢@zvi Rosenfeld和@erickson
Sorry on late answer on this..I have made many attempts to resolve this for checkmarks report here below.
HtmlUtils.htmlEscape-> not workedStringEscapeUtils.escapeJava-> not workedfinally
String cleanCorrelationId = correlationId.replace('\t', '_').replace('\n', '_').replace('\r', '_');and placed "cleanCorrelationId" in logging and
LogForgingissue resolved from checkmarks report.Many thanks @Zvi Rosenfeld and @erickson
当攻击者可以控制写入日志的字符串时（在这种情况下为“相关性”）时，就会发生日志锻造。
有2种危险：
您可以阅读有关它的更多信息在这里。
在您的情况下，最好的解决方案可能是验证相关性为预期的格式（假设coloreLationId formant不包含任何特殊字符。如果剂量剂量，则应禁止它们）。
Log Forging happens when an attacker can control a string that's written to the log (the "correlationId" in this case).
There are 2 dangers with this:
You can read more about it here.
In your case, the best solution would probably be to validate that the correlationId is in the expected format (assuming that the correlationId formant doesn't contain any specials characters. If it dose you should disallow them).