SVigo172076 (Community Member) asked a question.
I'm currently working on resolving a vulnerability issues reported by Veracode, specifically CWE 117 (Improper Output Neutralization for Logs). To address this issue, I need to implement the Veracode logging formatter library available at logging-formatter-anticrlf in my Django project.
Django has a special way to configurate the logging in its settings.py file:
# Logging
LOGGING = {
'version': 1,
'formatters': {
'verbose': {
'format': '{levelname} {asctime} {filename}:{lineno} {message}',
'style': '{',
},
'simple': {
'format': '{levelname} {message}',
'style': '{',
},
},
'handlers': {
'console': {
'level': 'DEBUG',
'class': 'logging.StreamHandler',
'formatter': 'verbose',
},
'file': {
'level': 'DEBUG',
'class': 'concurrent_log_handler.ConcurrentRotatingFileHandler',
'filename': os.path.join(BASE_DIR, '..', '..', 'log-debug.log'),
'maxBytes': 1024 * 1024 * 1024,
'backupCount': 365 * 7,
'formatter': 'verbose',
},
},
'root': {
'handlers': ['console', 'file', 'errorfile'],
'level': 'DEBUG',
},
'loggers': {
'root': {
'handlers': ['console', 'file', 'errorfile'],
'propagate': True,
'level': 'DEBUG',
},
'django.request': {
'handlers': ['console', 'file', 'errorfile'],
'propagate': False,
'level': 'DEBUG',
},
'django.server': {
'handlers': ['console', 'errorfile'],
'propagate': False,
'level': 'DEBUG',
},
'webportal': {
'handlers': ['console', 'file', 'errorfile'],
'propagate': False,
'level': 'DEBUG',
},
}
}
My problem is that I'm unsure where and how to define the anticrlf.LogFormatter() to make it utilized by Django because the provided examples don't show how use it in this framework.
Did anyone have to solve something like this?
Thanks in advance!
.png){kind=logo}
I found the problem. In case it helps anyone, it turns out that the python module to sanitize the logging messages proposed by Veracode is outdated with respect to the most modern versions of python and specifically with respect to the logging module which it uses. The github project hasn't had any codebase updates for 5 years. The issue is that Django via dictconfig() format logging configuration now accepts a 'style' parameter in LogFormatter definition. That parameter is not handled in the proposed anticrlf module. The solution was to install the module as an internal module of the project (not with pip) and update the code by adding the 'style' parameter to the constructor of the class that is implemented inside. With this, the LogFormater can be set in the Django logging configuration as follows: