[LOG4J2-1203] Allow filtering of line breaks in layout pattern

• Type: New Feature
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.4.1
• Fix Version/s: 2.10.0
• Component/s: Pattern Converters
• Assignee: Mikael Ståldal
• Reporter: Mitth'raw'nuruodo
• Created: 23/Nov/15 05:21
• Updated: 21/Sep/19 17:17
• Resolved: 05/Nov/17 15:02

Description

Unless specific steps are taken to filter log inputs, there may be a risk of CRLF injection, allowing an attacker to forge log entries: https://cwe.mitre.org/data/definitions/93.html

This is not a critical vulnerability, but manually escaping/encoding/sanitising every instance of logging in a large application is impractical. Most applications have no need to output un-filtered line breaks, so they would benefit from a global option.

Could the list of pattern converters be extended to include a modifier to say that whitespace should be normalised (as per Commons Lang StringUtils.normaliseSpace)? Eg %_m

Alternatively, it would be simple to implement a wrapper that would apply normalisation to the output of another layout, but it would be more difficult to configure such a wrapper in XML, and it would affect the entire log output, effectively obliterating all padding modifiers.

Issue Links

• duplicates: LOG4J2-439 Create a LogEventPatternConverter to escape newlines and HTML special characters
• is duplicated by: LOG4J2-2359 Safe multiline messages
• relates to: LOG4J2-2103 XML encoding for PatternLayout
• links to: GitHub Pull Request #122