CO'Meara151458 (Community Member) asked a question.
How to fix for CWE 117 with Apache log4net?
I've been researching and trying to implement a way to resolve CWE 117. Currently, the best method I have is implementing the WebUtility.HtmlEncode() method like so:
log.ErrorFormat("Interface version was not accepted by 3M. Error Code: {0} Error Message: {1}", errorCode, errorText);
to
log.ErrorFormat(WebUtility.HtmlEncode(string.Format("Interface version was not accepted by 3M. Error Code: {0} Error Message: {1}", errorCode, errorText)))
But is there a way to change log4net's methods directly to resolve CWE 117 (Not only mitigate)? There are thousands of log statements within this solution, it would be much easier to change the log4net methods themself.
.png){kind=logo}
Hi,
You can change the method to use one of our supported cleansing functions:
https://docs.veracode.com/r/Supported_Java_Cleansing_Functions
We recommend you santize the specific string values which are dynamically generated with one of the supporter cleansers, in this case potentially 'errorCode' and 'errorText'.
We would not be able to pick up any configurations in Apache log4et.
Thanks
Thilagshan