Skip to content

Commit e071f27

Browse files
xeno6696xeno6696
authored
Merge pull request ESAPI#533 from jeremiahjstacey/Logger_Consistency
ESAPI#532 JUL and Log4J match SLF4J class structure and Workflow
2 parents ddfa6ce + 724ffdd commit e071f27

File tree

58 files changed

+3808
-1980
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+3808
-1980
lines changed

‎configuration/esapi/ESAPI.properties

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ ESAPI.Executor=org.owasp.esapi.reference.DefaultExecutor
6767
ESAPI.HTTPUtilities=org.owasp.esapi.reference.DefaultHTTPUtilities
6868
ESAPI.IntrusionDetector=org.owasp.esapi.reference.DefaultIntrusionDetector
6969
# Log4JFactory Requires log4j.xml or log4j.properties in classpath - http://www.laliluna.de/log4j-tutorial.html
70-
ESAPI.Logger=org.owasp.esapi.reference.Log4JLogFactory
70+
ESAPI.Logger=org.owasp.esapi.logging.log4j.Log4JLogFactory
7171
#ESAPI.Logger=org.owasp.esapi.reference.JavaLogFactory
7272
# To use the new SLF4J logger in ESAPI (see GitHub issue #129), set
7373
# ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory
@@ -391,7 +391,10 @@ Logger.LogServerIP=true
391391
Logger.LogFileName=ESAPI_logging_file
392392
# MaxLogFileSize, the max size (in bytes) of a single log file before it cuts over to a new one (default is 10,000,000)
393393
Logger.MaxLogFileSize=10000000
394-
394+
# Determines whether ESAPI should log the user info.
395+
Logger.UserInfo=true
396+
# Determines whether ESAPI should log the app info.
397+
Logger.ClientInfo=true
395398

396399
#===========================================================================
397400
# ESAPI Intrusion Detection

‎configuration/log4j.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,6 @@
4242
<appender-ref ref="console" />
4343
</root>
4444

45-
<loggerFactory class="org.owasp.esapi.reference.Log4JLoggerFactory"/>
45+
<loggerFactory class="org.owasp.esapi.logging.log4j.Log4JLogFactory"/>
4646

4747
</log4j:configuration>

‎src/main/java/org/owasp/esapi/logging/appender/ClientInfoSupplier.java

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
/**
2+
* OWASP Enterprise Security API (ESAPI)
3+
*
4+
* This file is part of the Open Web Application Security Project (OWASP)
5+
* Enterprise Security API (ESAPI) project. For details, please see
6+
* <a href="http://www.owasp.org/index.php/ESAPI">http://www.owasp.org/index.php/ESAPI</a>.
7+
*
8+
* Copyright (c) 2007 - The OWASP Foundation
9+
*
10+
* The ESAPI is published by OWASP under the BSD license. You should read and accept the
11+
* LICENSE before you use, modify, and/or redistribute this software.
12+
*
13+
* @created 2019
14+
*/
15+
16+
package org.owasp.esapi.logging.appender;
17+
18+
import java.util.function.Supplier;
19+
20+
import javax.servlet.http.HttpServletRequest;
21+
import javax.servlet.http.HttpSession;
22+
23+
import org.owasp.esapi.ESAPI;
24+
import org.owasp.esapi.User;
25+
26+
/**
27+
* Supplier which can provide a String representing the client-side connection
28+
* information.
29+
*/
30+
public class ClientInfoSupplier implements Supplier<String> {
31+
/** Default Last Host string if the Authenticated user is null.*/
32+
private static final String DEFAULT_LAST_HOST = "#UNKNOWN_HOST#";
33+
/** Session Attribute containing the ESAPI Session id. */
34+
private static final String ESAPI_SESSION_ATTR = "ESAPI_SESSION";
35+
/**
36+
* Minimum value for generating a random session value if one is not defined.
37+
*/
38+
private static final int ESAPI_SESSION_RAND_MIN = 0;
39+
/**
40+
* Maximum value for generating a random session value if one is not defined.
41+
*/
42+
private static final int ESAPI_SESSION_RAND_MAX = 1000000;
43+
44+
/** Format for supplier output. */
45+
private static final String USER_INFO_FORMAT = "%s@%s"; // SID, USER_HOST_ADDRESS
46+
47+
/** Whether to log the user info from this instance. */
48+
private boolean logClientInfo = true;
49+
50+
@Override
51+
public String get() {
52+
String clientInfo = "";
53+
54+
if (logClientInfo) {
55+
HttpServletRequest request = ESAPI.currentRequest();
56+
// create a random session number for the user to represent the user's
57+
// 'session', if it doesn't exist already
58+
String sid = "";
59+
if (request != null) {
60+
HttpSession session = request.getSession(false);
61+
if (session != null) {
62+
sid = (String) session.getAttribute(ESAPI_SESSION_ATTR);
63+
// if there is no session ID for the user yet, we create one and store it in the
64+
// user's session
65+
if (sid == null) {
66+
sid = "" + ESAPI.randomizer().getRandomInteger(ESAPI_SESSION_RAND_MIN, ESAPI_SESSION_RAND_MAX);
67+
session.setAttribute(ESAPI_SESSION_ATTR, sid);
68+
}
69+
}
70+
}
71+
// log user information - username:session@ipaddr
72+
User user = ESAPI.authenticator().getCurrentUser();
73+
if (user == null) {
74+
clientInfo = String.format(USER_INFO_FORMAT, sid, DEFAULT_LAST_HOST);
75+
} else {
76+
clientInfo = String.format(USER_INFO_FORMAT, sid, user.getLastHostAddress());
77+
}
78+
}
79+
return clientInfo;
80+
}
81+
82+
/**
83+
* Specify whether the instance should record the client info.
84+
*
85+
* @param log {@code true} to record
86+
*/
87+
public void setLogClientInfo(boolean log) {
88+
this.logClientInfo = log;
89+
}
90+
91+
}

‎src/main/java/org/owasp/esapi/logging/appender/EventTypeLogSupplier.java

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
/**
2+
* OWASP Enterprise Security API (ESAPI)
3+
*
4+
* This file is part of the Open Web Application Security Project (OWASP)
5+
* Enterprise Security API (ESAPI) project. For details, please see
6+
* <a href="http://www.owasp.org/index.php/ESAPI">http://www.owasp.org/index.php/ESAPI</a>.
7+
*
8+
* Copyright (c) 2007 - The OWASP Foundation
9+
*
10+
* The ESAPI is published by OWASP under the BSD license. You should read and accept the
11+
* LICENSE before you use, modify, and/or redistribute this software.
12+
*
13+
* @created 2019
14+
*/
15+
16+
package org.owasp.esapi.logging.appender;
17+
18+
import java.util.function.Supplier;
19+
20+
import org.owasp.esapi.Logger;
21+
import org.owasp.esapi.Logger.EventType;
22+
23+
/**
24+
* Supplier implementation which returns a consistent String representation of
25+
* an EventType for logging
26+
*
27+
*/
28+
public class EventTypeLogSupplier implements Supplier<String> {
29+
/** EventType reference to supply log representation of. */
30+
private final EventType eventType;
31+
32+
/**
33+
* Ctr
34+
*
35+
* @param evtyp EventType reference to supply log representation for
36+
*/
37+
public EventTypeLogSupplier(EventType evtyp) {
38+
this.eventType = evtyp == null ? Logger.EVENT_UNSPECIFIED : evtyp;
39+
}
40+
41+
@Override
42+
public String get() {
43+
return eventType.toString();
44+
}
45+
}

‎src/main/java/org/owasp/esapi/logging/appender/LogAppender.java

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/**
2+
* OWASP Enterprise Security API (ESAPI)
3+
*
4+
* This file is part of the Open Web Application Security Project (OWASP)
5+
* Enterprise Security API (ESAPI) project. For details, please see
6+
* <a href="http://www.owasp.org/index.php/ESAPI">http://www.owasp.org/index.php/ESAPI</a>.
7+
*
8+
* Copyright (c) 2007 - The OWASP Foundation
9+
*
10+
* The ESAPI is published by OWASP under the BSD license. You should read and accept the
11+
* LICENSE before you use, modify, and/or redistribute this software.
12+
*
13+
* @created 2019
14+
*/
15+
16+
package org.owasp.esapi.logging.appender;
17+
18+
import org.owasp.esapi.Logger.EventType;
19+
20+
/**
21+
* Contract interface for appending content to a log message.
22+
*
23+
*/
24+
public interface LogAppender {
25+
26+
/**
27+
* Creates a replacement Log Message and returns it to the caller.
28+
* @param logName name of the logger.
29+
* @param eventType EventType of the log event being processed.
30+
* @param message The original message.
31+
* @return Updated replacement message.
32+
*/
33+
public String appendTo(String logName, EventType eventType, String message);
34+
35+
}

‎src/main/java/org/owasp/esapi/logging/appender/LogPrefixAppender.java

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
/**
2+
* OWASP Enterprise Security API (ESAPI)
3+
*
4+
* This file is part of the Open Web Application Security Project (OWASP)
5+
* Enterprise Security API (ESAPI) project. For details, please see
6+
* <a href="http://www.owasp.org/index.php/ESAPI">http://www.owasp.org/index.php/ESAPI</a>.
7+
*
8+
* Copyright (c) 2007 - The OWASP Foundation
9+
*
10+
* The ESAPI is published by OWASP under the BSD license. You should read and accept the
11+
* LICENSE before you use, modify, and/or redistribute this software.
12+
*
13+
* @created 2019
14+
*/
15+
16+
package org.owasp.esapi.logging.appender;
17+
18+
import org.owasp.esapi.Logger.EventType;
19+
20+
/**
21+
* LogAppender Implementation which can prefix the common logger information for
22+
* EventType, Client data, and server data.
23+
*/
24+
public class LogPrefixAppender implements LogAppender {
25+
/** Output format used to assemble return values. */
26+
private static final String RESULT_FORMAT = "[%s] %s"; //Assembled Prefix, MSG
27+
28+
/** Whether or not to record user information. */
29+
private final boolean logUserInfo;
30+
/** Whether or not to record client information. */
31+
private final boolean logClientInfo;
32+
/** Whether or not to record server ip information. */
33+
private final boolean logServerIp;
34+
/** Whether or not to record application name. */
35+
private final boolean logApplicationName;
36+
/** Application Name to record. */
37+
private final String appName;
38+
39+
/**
40+
* Ctr.
41+
*
42+
* @param logUserInfo Whether or not to record user information
43+
* @param logClientInfo Whether or not to record client information
44+
* @param logServerIp Whether or not to record server ip information
45+
* @param logApplicationName Whether or not to record application name
46+
* @param appName Application Name to record.
47+
*/
48+
public LogPrefixAppender(boolean logUserInfo, boolean logClientInfo, boolean logServerIp, boolean logApplicationName, String appName) {
49+
this.logUserInfo = logUserInfo;
50+
this.logClientInfo = logClientInfo;
51+
this.logServerIp = logServerIp;
52+
this.logApplicationName = logApplicationName;
53+
this.appName = appName;
54+
}
55+
56+
@Override
57+
public String appendTo(String logName, EventType eventType, String message) {
58+
EventTypeLogSupplier eventTypeSupplier = new EventTypeLogSupplier(eventType);
59+
60+
UserInfoSupplier userInfoSupplier = new UserInfoSupplier();
61+
userInfoSupplier.setLogUserInfo(logUserInfo);
62+
63+
ClientInfoSupplier clientInfoSupplier = new ClientInfoSupplier();
64+
clientInfoSupplier.setLogClientInfo(logClientInfo);
65+
66+
ServerInfoSupplier serverInfoSupplier = new ServerInfoSupplier(logName);
67+
serverInfoSupplier.setLogServerIp(logServerIp);
68+
serverInfoSupplier.setLogApplicationName(logApplicationName, appName);
69+
70+
String eventTypeMsg = eventTypeSupplier.get().trim();
71+
String userInfoMsg = userInfoSupplier.get().trim();
72+
String clientInfoMsg = clientInfoSupplier.get().trim();
73+
String serverInfoMsg = serverInfoSupplier.get().trim();
74+
75+
//If both user and client have content, then postfix the semicolon to the userInfoMsg at this point to simplify the StringBuilder operations later.
76+
userInfoMsg = (!userInfoMsg.isEmpty() && !clientInfoMsg.isEmpty()) ? userInfoMsg + ":" : userInfoMsg;
77+
78+
//If both server has content, then prefix the arrow to the serverInfoMsg at this point to simplify the StringBuilder operations later.
79+
serverInfoMsg = (!serverInfoMsg.isEmpty()) ? "-> " + serverInfoMsg: serverInfoMsg;
80+
81+
String[] optionalPrefixContent = new String[] {userInfoMsg + clientInfoMsg, serverInfoMsg};
82+
83+
StringBuilder logPrefix = new StringBuilder();
84+
//EventType is always appended
85+
logPrefix.append(eventTypeMsg);
86+
87+
for (String element : optionalPrefixContent) {
88+
if (!element.isEmpty()) {
89+
logPrefix.append(" ");
90+
logPrefix.append(element);
91+
}
92+
}
93+
94+
return String.format(RESULT_FORMAT, logPrefix.toString(), message);
95+
}
96+
}

‎src/main/java/org/owasp/esapi/logging/appender/ServerInfoSupplier.java

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
/**
2+
* OWASP Enterprise Security API (ESAPI)
3+
*
4+
* This file is part of the Open Web Application Security Project (OWASP)
5+
* Enterprise Security API (ESAPI) project. For details, please see
6+
* <a href="http://www.owasp.org/index.php/ESAPI">http://www.owasp.org/index.php/ESAPI</a>.
7+
*
8+
* Copyright (c) 2007 - The OWASP Foundation
9+
*
10+
* The ESAPI is published by OWASP under the BSD license. You should read and accept the
11+
* LICENSE before you use, modify, and/or redistribute this software.
12+
*
13+
* @created 2019
14+
*/
15+
16+
package org.owasp.esapi.logging.appender;
17+
18+
import java.util.function.Supplier;
19+
20+
import javax.servlet.http.HttpServletRequest;
21+
22+
import org.owasp.esapi.ESAPI;
23+
24+
/**
25+
* Supplier which can provide a String representing the server-side connection
26+
* information.
27+
*/
28+
public class ServerInfoSupplier implements Supplier<String> {
29+
/** Whether to log the server connection info. */
30+
private boolean logServerIP = true;
31+
/** Whether to log the application name. */
32+
private boolean logAppName = true;
33+
/** The application name to log. */
34+
private String applicationName = "";
35+
36+
/** Reference to the associated logname/module name. */
37+
private final String logName;
38+
39+
/**
40+
* Ctr.
41+
*
42+
* @param logName Reference to the logName to record as the module information
43+
*/
44+
public ServerInfoSupplier(String logName) {
45+
this.logName = logName;
46+
}
47+
48+
@Override
49+
public String get() {
50+
// log server, port, app name, module name -- server:80/app/module
51+
StringBuilder appInfo = new StringBuilder();
52+
HttpServletRequest request = ESAPI.currentRequest();
53+
if (request != null && logServerIP) {
54+
appInfo.append(request.getLocalAddr()).append(":").append(request.getLocalPort());
55+
}
56+
if (logAppName) {
57+
appInfo.append("/").append(applicationName);
58+
}
59+
appInfo.append("/").append(logName);
60+
61+
return appInfo.toString();
62+
}
63+
64+
/**
65+
* Specify whether the instance should record the server connection info.
66+
*
67+
* @param log {@code true} to record
68+
*/
69+
public void setLogServerIp(boolean log) {
70+
this.logServerIP = log;
71+
}
72+
73+
/**
74+
* Specify whether the instance should record the application name
75+
*
76+
* @param log {@code true} to record
77+
* @param appName String to record as the application name
78+
*/
79+
public void setLogApplicationName(boolean log, String appName) {
80+
this.logAppName = log;
81+
this.applicationName = appName;
82+
}
83+
}

0 commit comments

Comments
 (0)