Add support for log encoding
- Dominant language
- Java
- Stars
- 1.5k
- Forks
- 133
- Avg merge
- 6m
- Merged PRs (30d)
- 7
Description
It would be a nice if we had the option to encode / escape our log output.
Something like:
logger.atInfo().withCause(exception).encode().log("Log message with: %s", argument);
logger.atInfo().withCause(exception)..log("Log message with: %s", argument).encode();
logger.atInfo().withCause(exception).logEncoded("Log message with: %s", argument);
This way developers would become more security aware, and log forging would become allot harder overall.
Owasp already has an encoder for this:
https://mvnrepository.com/artifact/org.owasp.encoder/encoder/1.2.2
If you don't know what log forging is give this a read:
http://www.jtmelton.com/2010/09/21/preventing-log-forging-in-java/
Contributor guide
Assessment
This issue has not been assessed yet.