[ https://issues.apache.org/jira/browse/LOG4J2-1203?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16239573#comment-16239573 ]
ASF subversion and git services commented on LOG4J2-1203: --------------------------------------------------------- Commit 6b41f589781e8cdcaee0fac72ff4b75f538d89a6 in logging-log4j2's branch refs/heads/master from [~rtur...@e-djuster.com] [ https://git-wip-us.apache.org/repos/asf?p=logging-log4j2.git;h=6b41f58 ] LOG4J2-1203 Added Pattern encoding for CRLF only Added a Pattern encoding format limited to just CRLF for use cases where you do not want full HTML or JSON encoding, but do want to protected against CR and/or LF injection attacks in logs. > Allow filtering of line breaks in layout pattern > ------------------------------------------------ > > Key: LOG4J2-1203 > URL: https://issues.apache.org/jira/browse/LOG4J2-1203 > Project: Log4j 2 > Issue Type: New Feature > Components: Pattern Converters > Affects Versions: 2.4.1 > Reporter: Mitth'raw'nuruodo > Assignee: Mikael Ståldal > Priority: Minor > Fix For: 2.0-rc2 > > Attachments: > 0001-LOG4J2-1203-Added-Pattern-encoding-for-CRLF-only.patch > > > Unless specific steps are taken to filter log inputs, there may be a risk of > CRLF injection, allowing an attacker to forge log entries: > https://cwe.mitre.org/data/definitions/93.html > This is not a critical vulnerability, but manually > escaping/encoding/sanitising every instance of logging in a large application > is impractical. Most applications have no need to output un-filtered line > breaks, so they would benefit from a global option. > Could the list of pattern converters be extended to include a modifier to say > that whitespace should be normalised (as per Commons Lang > {{StringUtils.normaliseSpace}})? Eg {{%_m}} > Alternatively, it would be simple to implement a wrapper that would apply > normalisation to the output of another layout, but it would be more difficult > to configure such a wrapper in XML, and it would affect the entire log > output, effectively obliterating all padding modifiers. -- This message was sent by Atlassian JIRA (v6.4.14#64029)