Improper Output Neutralization for Logs [VID:117:com/veracode/verademo/controller/BlabController.java:559]

[github-actions[bot]]

https://github.com/wasptree/verademo/blob/4309a98630cec73c2b89411d6a9a0f8a43db82a7/src/main/java/com/veracode/verademo/controller/BlabController.java#L554-L564

Filename: com/veracode/verademo/controller/BlabController.java

Line: 559

CWE: 117 (Improper Output Neutralization for Logs)

This call to org.apache.log4j.Category.info() could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker's tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The first argument to info() contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP Supported Cleansers

[github-actions[bot]]

Veracode issue link to PR: https://github.com/wasptree/verademo/pull/604