Uploaded image for project: 'Log4j 2'
  1. Log4j 2
  2. LOG4J2-1203

Allow filtering of line breaks in layout pattern

    Details

    • Type: New Feature
    • Status: Closed
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 2.4.1
    • Fix Version/s: 2.10.0
    • Component/s: Pattern Converters
    • Labels:
      None

      Description

      Unless specific steps are taken to filter log inputs, there may be a risk of CRLF injection, allowing an attacker to forge log entries: https://cwe.mitre.org/data/definitions/93.html

      This is not a critical vulnerability, but manually escaping/encoding/sanitising every instance of logging in a large application is impractical. Most applications have no need to output un-filtered line breaks, so they would benefit from a global option.

      Could the list of pattern converters be extended to include a modifier to say that whitespace should be normalised (as per Commons Lang StringUtils.normaliseSpace)? Eg %_m

      Alternatively, it would be simple to implement a wrapper that would apply normalisation to the output of another layout, but it would be more difficult to configure such a wrapper in XML, and it would affect the entire log output, effectively obliterating all padding modifiers.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                mikaelstaldal Mikael Ståldal
                Reporter:
                thrawnca Mitth'raw'nuruodo
              • Votes:
                0 Vote for this issue
                Watchers:
                6 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: