javaloggingjava-8esapi

Can we add markers to ESAPI Slf4JLogFactory logger


So for Normal sl4j logging they do provide options to add markers.

Map<String, Object> markers = new HashMap<>();
markers.put("name", "value");
log.info(markers,"Some value");

But due to security reasons the code base has used org.owasp.esapi.logging.slf4j.Slf4JLogFactory which is like

private static final Logger LOG = ESAPI.getLogger(Some.class);
LOG.info(Some event type, some string....)

I want to add a marker here so that without compromising the security provided by esapi. Any help would be great. There is not over internet about this.


Solution

  • I see multiple problems with this. Among them are:

    1. The 3 implementations of ESAPIs loggers (so, JUL, Log4J 1, and SLF4J) all share the same org.owasp.esapi.Logger interface, but as far as I know, only SLF4J supports markers.
    2. ESAPI would have to then examine the name/value pairs of all the markers and try ensure that log injection or that XSS from any of the name/value pairs, including any potential object cannot inject something harmful into the log stream. (That's what 'safe logging' should be.)
    3. Even if we did allow this, the first argument would still have to be an Logger.EventType. It is not clear what event type should be used or whether an special one (e.g., EVENT_MARKER) would need to be created.

    So, I will say unequivocally, we will not consider this for any ESAPI 2.x release, but we might consider it for ESAPI 3 which we are currently planning. If you would like to see it there, add a GitHub issue to https://github.com/ESAPI/esapi-java/issues and note it as a feature request.(It may be plausible in ESAPI 3 because we likely will only support SLF4J there.)