google / google/polymorphicDSL

Find a secure way to log to the console

Open
#11 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
17
Forks
10
PR merge metrics
No merged PRs in 30d

Description

System.out can be used by malicious attackers to gather information for a future attack.

We somewhat mitigated this by introducting the `PdslThreadSafeOutputStream` as the default printer, however this class has a vulnerability in its static constructor. Because we manually associate a handler with it we have a risk (albeit lower than previously) of a security exploit.

We might be able to get around this by writing our own logger or something else. We might just accept the risk as it is admittedly low.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.