javamaven-3esapiembedded-tomcat-7

How to suppress messages output by ESAPI library


Does anyone know how to suppress the following noisy messages output by the ESAPI library?

System property [org.owasp.esapi.opsteam] is not setAttempting to load ESAPI.properties via file I/O.
Attempting to load ESAPI.properties as resource file via file I/O.

System property [org.owasp.esapi.devteam] is not set
Not found in 'org.owasp.esapi.resources' directory or file not readable: C:\Users\ktamura\Desktop\embtest-master\ESAPI.properties
Not found in SystemResource Directory/resourceDirectory: .esapi\ESAPI.properties
Not found in 'user.home' (C:\Users\ktamura) directory: C:\Users\ktamura\esapi\ESAPI.properties
Loading ESAPI.properties via file I/O failed. Exception was: java.io.FileNotFoundException
Attempting to load ESAPI.properties via the classpath.
SUCCESSFULLY LOADED ESAPI.properties via the CLASSPATH from '/ (root)' using current thread context class loader!
SecurityConfiguration for Validator.ConfigurationFile.MultiValued not found in ESAPI.properties. Using default: false
Attempting to load validation.properties via file I/O.
Attempting to load validation.properties as resource file via file I/O.
Not found in 'org.owasp.esapi.resources' directory or file not readable: C:\Users\ktamura\Desktop\embtest-master\validation.properties
Not found in SystemResource Directory/resourceDirectory: .esapi\validation.properties
Not found in 'user.home' (C:\Users\ktamura) directory: C:\Users\ktamura\esapi\validation.properties
Loading validation.properties via file I/O failed.
Attempting to load validation.properties via the classpath.
validation.properties could not be loaded by any means. fail. Exception was: java.lang.IllegalArgumentException: Failed to load ESAPI.properties as a classloader resource.

I added the library to my web application (including embedded Tomcat) and ESAPI validation works but noisy messages are output.

Java code:

writer.write(ESAPI.encoder().encodeForHTML("<test>"));

Dependency of ESAPI:

<dependency>
    <groupId>org.owasp.esapi</groupId>
    <artifactId>esapi</artifactId>
    <version>2.1.0.1</version>
</dependency>

ESAPI.properties:

https://github.com/k-tamura/embtest/blob/master/src/main/resources/ESAPI.properties

Steps to reproduce:

(1) Run the commands:

$ git clone https://github.com/k-tamura/embtest.git
$ cd embtest
$ mvn clean install

(2) Access to http://localhost:8080/ping -> The above logs are shown on console.

Environment (my local machine):

$ mvn -version
Apache Maven 3.2.2 (45f7c06d68e745d05611f7fd14efb6594181933e; 2014-06-17T22:51:42+09:00)
Maven home: c:\apache-maven-3.2.2
Java version: 1.8.0_121, vendor: Oracle Corporation
Java home: c:\Program Files\Java\jdk1.8.0_121\jre
Default locale: ja_JP, platform encoding: MS932
OS name: "windows 7", version: "6.1", arch: "amd64", family: "dos"

Solution

  • I can work around this issue to add the InitializationListener by referring to @avgvstvs's answer:

    import java.io.OutputStream;
    import java.io.PrintStream;
    
    import javax.servlet.ServletContextEvent;
    import javax.servlet.ServletContextListener;
    import javax.servlet.annotation.WebListener;
    
    import org.owasp.esapi.ESAPI;
    
    @WebListener
    public class InitializationListener implements ServletContextListener {
        public void contextInitialized(ServletContextEvent event) {
    
            /* Suppress noisy messages output by the ESAPI library. */
            PrintStream original = System.out;
            try (PrintStream out = new PrintStream(new OutputStream() {
                @Override
                public void write(int b) {
                    // Do nothing
                }
            })) {
                System.setOut(out);
                System.setErr(out);
                ESAPI.encoder();
            } catch (Exception e) {
                // Do nothing
            } finally {
                System.setOut(original);
            }
        }
    
        @Override
        public void contextDestroyed(ServletContextEvent sce) {
            // Do nothing
        }
    }