|
1 | | -This release includes critical changes to the ESAPI Log4JLogger that will now allow you to over-ride the user specific |
2 | | -message using your own User or java.security.Principal implementation. |
3 | | -
|
4 | | -There are a three critical steps that need to be taken to over-ride the ESAPI Log4JLogger: |
5 | | -
|
6 | | -1) Please make a copy of http://owasp-esapi-java.googlecode.com/svn/trunk/src/main/java/org/owasp/esapi/reference/ExampleExtendedLog4JLogFactory.java and change the package and the class name (something like com.yourcompany.logging.ExtendedLog4JFactory). This class (not very big at all) gives you the exact “shell” that you will need to over-ride the user message of the ESAPI Log4JLogger. |
7 | | -
|
8 | | -2) In your new class, please change the following function to use your user object: |
9 | | -
|
10 | | - public String getUserInfo() { |
11 | | - return "-EXTENDEDUSERINFO-"; |
12 | | - } |
13 | | -
|
14 | | -3) Change your copy of ESAPI.properties to use your new logging class |
15 | | -
|
16 | | -The ESAPI.properties entry looks like this now: |
17 | | -
|
18 | | -ESAPI.Logger=org.owasp.esapi.reference.Log4JLogFactory |
19 | | -
|
20 | | -Please change it to the following, based on how you renamed your new logging class |
21 | | -
|
22 | | -ESAPI.Logger=com.yourcompany.logging.ExtendedLog4JFactory |
23 | | -
|
24 | | -And you should be all set! |
25 | | -
|
26 | | -PS: The original ESAPI Log4JLogging class used a secure random number as a replacement to logging the session ID. This allowed |
27 | | -us to tie log messages from the same session together, without exposing the actual session id in the log file. The code looks |
28 | | -like this, and you may wish to use it in your over-ridden version of getUserInfo. |
29 | | -
|
30 | | -HttpServletRequest request = ESAPI.httpUtilities().getCurrentRequest(); |
31 | | -if ( request != null ) { |
32 | | - HttpSession session = request.getSession( false ); |
33 | | - if ( session != null ) { |
34 | | - sid = (String)session.getAttribute("ESAPI_SESSION"); |
35 | | - // if there is no session ID for the user yet, we create one and store it in the user's session |
36 | | - if ( sid == null ) { |
37 | | - sid = ""+ ESAPI.randomizer().getRandomInteger(0, 1000000); |
38 | | - session.setAttribute("ESAPI_SESSION", sid); |
39 | | - } |
40 | | - } |
41 | | -} |
42 | | -
|
43 | | -In fact, here is the entire original getUserInfo() implementation (that was tied to the ESAPI request and user object) – |
44 | | -you may wish to emulate some of this. |
45 | | -
|
46 | | -public String getUserInfo() { |
47 | | - // create a random session number for the user to represent the user's 'session', if it doesn't exist already |
48 | | - String sid = null; |
49 | | - HttpServletRequest request = ESAPI.httpUtilities().getCurrentRequest(); |
50 | | - if ( request != null ) { |
51 | | - HttpSession session = request.getSession( false ); |
52 | | - if ( session != null ) { |
53 | | - sid = (String)session.getAttribute("ESAPI_SESSION"); |
54 | | - // if there is no session ID for the user yet, we create one and store it in the user's session |
55 | | - if ( sid == null ) { |
56 | | - sid = ""+ ESAPI.randomizer().getRandomInteger(0, 1000000); |
57 | | - session.setAttribute("ESAPI_SESSION", sid); |
58 | | - } |
59 | | - } |
60 | | - } |
61 | | - |
62 | | - // log user information - username:session@ipaddr |
63 | | - User user = ESAPI.authenticator().getCurrentUser(); |
64 | | - String userInfo = ""; |
65 | | - //TODO - make type logging configurable |
66 | | - if ( user != null) { |
67 | | - userInfo += user.getAccountName()+ ":" + sid + "@"+ user.getLastHostAddress(); |
68 | | - } |
69 | | - |
70 | | - return userInfo; |
71 | | -} |
| 1 | +This release includes critical changes to the ESAPI Log4JLogger that will now allow you to over-ride the user specific |
| 2 | +message using your own User or java.security.Principal implementation. |
| 3 | + |
| 4 | +There are a three critical steps that need to be taken to over-ride the ESAPI Log4JLogger: |
| 5 | + |
| 6 | +1) Please make a copy of http://owasp-esapi-java.googlecode.com/svn/trunk/src/main/java/org/owasp/esapi/reference/ExampleExtendedLog4JLogFactory.java and change the package and the class name (something like com.yourcompany.logging.ExtendedLog4JFactory). This class (not very big at all) gives you the exact “shell” that you will need to over-ride the user message of the ESAPI Log4JLogger. |
| 7 | + |
| 8 | +2) In your new class, please change the following function to use your user object: |
| 9 | + |
| 10 | + public String getUserInfo() { |
| 11 | + return "-EXTENDEDUSERINFO-"; |
| 12 | + } |
| 13 | + |
| 14 | +3) Change your copy of ESAPI.properties to use your new logging class |
| 15 | + |
| 16 | +The ESAPI.properties entry looks like this now: |
| 17 | + |
| 18 | +ESAPI.Logger=org.owasp.esapi.reference.Log4JLogFactory |
| 19 | + |
| 20 | +Please change it to the following, based on how you renamed your new logging class |
| 21 | + |
| 22 | +ESAPI.Logger=com.yourcompany.logging.ExtendedLog4JFactory |
| 23 | + |
| 24 | +And you should be all set! |
| 25 | + |
| 26 | +PS: The original ESAPI Log4JLogging class used a secure random number as a replacement to logging the session ID. This allowed |
| 27 | +us to tie log messages from the same session together, without exposing the actual session id in the log file. The code looks |
| 28 | +like this, and you may wish to use it in your over-ridden version of getUserInfo. |
| 29 | + |
| 30 | +HttpServletRequest request = ESAPI.httpUtilities().getCurrentRequest(); |
| 31 | +if ( request != null ) { |
| 32 | + HttpSession session = request.getSession( false ); |
| 33 | + if ( session != null ) { |
| 34 | + sid = (String)session.getAttribute("ESAPI_SESSION"); |
| 35 | + // if there is no session ID for the user yet, we create one and store it in the user's session |
| 36 | + if ( sid == null ) { |
| 37 | + sid = ""+ ESAPI.randomizer().getRandomInteger(0, 1000000); |
| 38 | + session.setAttribute("ESAPI_SESSION", sid); |
| 39 | + } |
| 40 | + } |
| 41 | +} |
| 42 | + |
| 43 | +In fact, here is the entire original getUserInfo() implementation (that was tied to the ESAPI request and user object) – |
| 44 | +you may wish to emulate some of this. |
| 45 | + |
| 46 | +public String getUserInfo() { |
| 47 | + // create a random session number for the user to represent the user's 'session', if it doesn't exist already |
| 48 | + String sid = null; |
| 49 | + HttpServletRequest request = ESAPI.httpUtilities().getCurrentRequest(); |
| 50 | + if ( request != null ) { |
| 51 | + HttpSession session = request.getSession( false ); |
| 52 | + if ( session != null ) { |
| 53 | + sid = (String)session.getAttribute("ESAPI_SESSION"); |
| 54 | + // if there is no session ID for the user yet, we create one and store it in the user's session |
| 55 | + if ( sid == null ) { |
| 56 | + sid = ""+ ESAPI.randomizer().getRandomInteger(0, 1000000); |
| 57 | + session.setAttribute("ESAPI_SESSION", sid); |
| 58 | + } |
| 59 | + } |
| 60 | + } |
| 61 | + |
| 62 | + // log user information - username:session@ipaddr |
| 63 | + User user = ESAPI.authenticator().getCurrentUser(); |
| 64 | + String userInfo = ""; |
| 65 | + //TODO - make type logging configurable |
| 66 | + if ( user != null) { |
| 67 | + userInfo += user.getAccountName()+ ":" + sid + "@"+ user.getLastHostAddress(); |
| 68 | + } |
| 69 | + |
| 70 | + return userInfo; |
| 71 | +} |
0 commit comments