google / google/flogger

Add support for log encoding

Open
#162 1 comment 0 reactions 0 assignees View on GitHub
P4 type=addition
Dominant language
Java
Stars
1.5k
Forks
133
Avg merge
6m
Merged PRs (30d)
7

Description

It would be a nice if we had the option to encode / escape our log output.
Something like:
logger.atInfo().withCause(exception).encode().log("Log message with: %s", argument);
logger.atInfo().withCause(exception)..log("Log message with: %s", argument).encode();
logger.atInfo().withCause(exception).logEncoded("Log message with: %s", argument);
This way developers would become more security aware, and log forging would become allot harder overall.
Owasp already has an encoder for this:
https://mvnrepository.com/artifact/org.owasp.encoder/encoder/1.2.2
If you don't know what log forging is give this a read:
http://www.jtmelton.com/2010/09/21/preventing-log-forging-in-java/

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.