Search code examples
javaspring-bootspring-mvccheckmarxsecure-coding

Checkmarx Java fix for Log Forging -sanitizing user input

Can anyone suggest the proper sanitization/validation process required for the courseType variable in the following getCourses method. I am using that variable to write in a log file.

I've tried HtmlUtils.HtmlEscape() but didn't get expected results.

Thanks!

@RequestMapping(value = "/retriveCourses", method = RequestMethod.GET)
@ResponseBody
public List<Course> getCourses(@RequestParam(value = "courseType", required = false) String courseType) {

}
Solution

  • it seems like the Checkmarx tool is correct in this case.

    A "Log Forging" vulnerability means that an attacker could engineer logs of security-sensitive actions and lay a false audit trail, potentially implicating an innocent user or hiding an incident.

    While using htmlEscape will escape some special characters:

    • &amplt; represents the < sign.
    • &ampgt; represents the > sign.
    • &ampamp; represents the & sign.
    • &ampquot; represents the " mark.

    It will not escape or remove new-line/EOL/tab characters that must be avoided in order to keep logs integrity.

    The best practice recommendations to avoid log forging are:

    1. Make sure to replace all relevant dangerous characters. example:

      cleanInput = input.replace('\t', '-').replace('\n', '-').replace('\r', '-');

    2. Validate all input, regardless of source. Validation should be based on a whitelist. Accept only data fitting a specified structure, rather than reject bad patterns. Check for: Data type, Size, Range, Format, Expected values.

    Hopefully, that solves your problem.