https://issues.apache.org/bugzilla/show_bug.cgi?id=44697
Summary: AccessValveLog doesn't escape URIs like HTTPd
Product: Tomcat 5
Version: 5.5.20
Platform: All
OS/Version: All
Status: NEW
Severity: major
Priority: P2
Component: Unknown
AssignedTo: [EMAIL PROTECTED]
ReportedBy: [EMAIL PROTECTED]
Here's my Valve (ripped off from the Tomcat docs):
<Valve className="org.apache.catalina.valves.AccessLogValve"
directory="logs" prefix="trovix_access_log." suffix=".txt"
pattern='%h %l %u %t "%r" %s %b "%{Referer}i" "%{User-Agent}i" %A %v
"%{x-forwarded-for}i" og=%{og}c Session=%S Time=%D' resolveHosts="false"/>
When I do:
curl 'http://localhost:8080/";'
The quote shows up literally in the log.
On httpd 2.2.3 I get a backslash escaped quote. I don't know what other naughty
characters also mess up logging.
127.0.0.1 - - [27/Mar/2008:18:07:48 -0700] "GET /\" HTTP/1.1" 404 278 "-"
"curl/7.15.5 (x86_64-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3
libidn/0.6.5"
httpd again:
curl -D - 'http://localhost/ HTTP/1.1"'
127.0.0.1 - - [27/Mar/2008:18:15:30 -0700] "GET / HTTP/1.1\" HTTP/1.1" 200 916
"-" "curl/7.15.5 (x86_64-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b
zlib/1.2.3 libidn/0.6.5"
I believe this is major because I cannot parse the logs without also looking
out for people injecting garbage to poison the logs.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
