UnInitialized esapi logging assumes logging to System.out/System.err - Make configurable/extensible

[GoogleCodeExporter]

Uninitialized logging calls logSpecial, which in turn calls System.out. This 
behavior should be configurable with an option to turn console logging off. 
Ideally, this behavior should be extensible so that a custom logging 
implementation can override the logSpecial method with a custom implementation.

Original email to esapi-user list: 

I'm having an issue with logging in esapi.

When my application is starting up, it initializes it's logging and does other 
things, then it loads esapi. The esapi logger is not initialized yet so it 
dumps a bunch of logging messages to System.out via the logSpecial() method.

What I would like is a way to configure esapi to disable console logging or to 
redirect console logging to another type of object which then could be used by 
my application that already has it's loggings system initialized.

This is the issue that I'm currently having. My server is a console-based app. 
Startup should look like this:

MyApp Service Starting
  License successfully validated
  Loading database schemas
    Database schema being created or updated for MyApp
  Finished loading database schemas
MyApp Service Started

Instead, it looks like this:

MyApp Service Starting
  License successfully validated
  Loading database schemas
    Database schema being created or updated for MyApp
  Finished loading database schemas
Attempting to load ESAPI.properties via file io.
Attempting to load ESAPI.properties via file io.
Found in 'org.owasp.esapi.resources' directory: 
C:\MyApp\conf\esapi\ESAPI.properties
Loaded 'ESAPI.properties' properties file
Attempting to load validation.properties via file io.
Attempting to load validation.properties via file io.
Found in 'org.owasp.esapi.resources' directory: 
C:\MyApp\conf\esapi\validation.properties
Loaded 'validation.properties' properties file
MyApp Service Started

Redirecting System.out and System.err to log4j (what my app uses) prior to 
esapi loading solves this issue, the problem then is that the last line "MyApp 
Service Started" never appears, which is critical.

Original issue reported on code.google.com by Steve.Sp...@gmail.com on 3 Dec 2010 at 5:46

[GoogleCodeExporter]

It would be great if logging to sys.out is configurable option. In short lived 
process, Frequent initialization happens a lot and annoying if the stdout logs 
are routed to mails

Original comment by chandrasekar.m@gmail.com on 9 Feb 2011 at 2:17

[GoogleCodeExporter]

+1 for this. Great example is during unit tests where I have to configure each 
one to suppress output from ESAPI.

Original comment by matthew....@gmail.com on 25 Apr 2013 at 4:03

[GoogleCodeExporter]

Original comment by M.Gelma...@gmail.com on 13 Nov 2014 at 5:32

[GoogleCodeExporter]

Original comment by M.Gelma...@gmail.com on 13 Nov 2014 at 5:51

• Added labels: Type-Defect