marcelhoelscher commented on issue #2518:
URL:
https://github.com/apache/logging-log4j2/issues/2518#issuecomment-2095301974
Hey @ppkarwasz,
thanks for your reply!
We're not concerned about developers putting CR or LF into log messages,
we're concerned about attackers who (for example) manipulate query parameters
in URLs.
So i think the relevant places in the log pattern are the message and the
stacktrace. The message is safe when using the %encode{%m}{CRLF} conversion
pattern. But the stacktraces are problematic.
I understand, that it is no option to simply escape any CR / LF because the
stacktrace then gets unreadable and there is no way to differentiate between
"desired" and "undesired" control characters. But developers searching for
information about this topic may think that it's sufficient to wrap the log
message into the conversion pattern. It may be not very obvious, that there
still may be undesired control characters in the stacktraces. It may be worth
mentioning, that there also existst the implicit %xEx-Pattern that may contain
control characters.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
