google / google/polymorphicDSL
Find a secure way to log to the console
Open
- Dominant language
- Java
- Stars
- 17
- Forks
- 10
- PR merge metrics
- No merged PRs in 30d
Description
System.out can be used by malicious attackers to gather information for a future attack.
We somewhat mitigated this by introducting the `PdslThreadSafeOutputStream` as the default printer, however this class has a vulnerability in its static constructor. Because we manually associate a handler with it we have a risk (albeit lower than previously) of a security exploit.
We might be able to get around this by writing our own logger or something else. We might just accept the risk as it is admittedly low.
Contributor guide
Assessment
This issue has not been assessed yet.