Skip to content

Commit 7a9ec00

Browse files
jeremiahjstaceyjeremiahjstacey
authored
Issue #839 JavaLogFactory ConcMod (#840)
* Issue #839 JavaLogFactory ConcMod Removing support for esapi-java-logging.properties file from baseline. ConfigurationException is thrown if file is found on the path at runtime. Exception message links to a wiki page with instructions on how to configure the application instance. * JavaLogFactory Cleanup Removing unused imports. Consolidating String duplication to a class constant.
1 parent a3a59dc commit 7a9ec00

File tree

4 files changed

+21
-134
lines changed

4 files changed

+21
-134
lines changed

‎configuration/esapi/esapi-java-logging.properties

-6
This file was deleted.

‎src/main/java/org/owasp/esapi/logging/java/JavaLogFactory.java

+21-40
Original file line numberDiff line numberDiff line change
@@ -14,18 +14,23 @@
1414
*/
1515
package org.owasp.esapi.logging.java;
1616

17+
import static org.owasp.esapi.PropNames.APPLICATION_NAME;
18+
import static org.owasp.esapi.PropNames.LOG_APPLICATION_NAME;
19+
import static org.owasp.esapi.PropNames.LOG_CLIENT_INFO;
20+
import static org.owasp.esapi.PropNames.LOG_ENCODING_REQUIRED;
21+
import static org.owasp.esapi.PropNames.LOG_SERVER_IP;
22+
import static org.owasp.esapi.PropNames.LOG_USER_INFO;
23+
1724
import java.io.IOException;
1825
import java.io.InputStream;
1926
import java.util.ArrayList;
2027
import java.util.HashMap;
2128
import java.util.List;
2229
import java.util.Map;
23-
import java.util.logging.LogManager;
2430

2531
import org.owasp.esapi.ESAPI;
2632
import org.owasp.esapi.LogFactory;
2733
import org.owasp.esapi.Logger;
28-
import org.owasp.esapi.PropNames;
2934
import org.owasp.esapi.codecs.HTMLEntityCodec;
3035
import org.owasp.esapi.errors.ConfigurationException;
3136
import org.owasp.esapi.logging.appender.LogAppender;
@@ -35,13 +40,6 @@
3540
import org.owasp.esapi.logging.cleaning.LogScrubber;
3641
import org.owasp.esapi.logging.cleaning.NewlineLogScrubber;
3742

38-
import static org.owasp.esapi.PropNames.LOG_ENCODING_REQUIRED;
39-
import static org.owasp.esapi.PropNames.LOG_USER_INFO;
40-
import static org.owasp.esapi.PropNames.LOG_CLIENT_INFO;
41-
import static org.owasp.esapi.PropNames.LOG_APPLICATION_NAME;
42-
import static org.owasp.esapi.PropNames.APPLICATION_NAME;
43-
import static org.owasp.esapi.PropNames.LOG_SERVER_IP;
44-
4543
/**
4644
* LogFactory implementation which creates JAVA supporting Loggers.
4745
* <br><br>
@@ -58,6 +56,8 @@
5856
*
5957
*/
6058
public class JavaLogFactory implements LogFactory {
59+
/**Consistent message offered as a part of the ConfigurationException which is thrown if esapi-java-logging.properties is found on the path. */
60+
private static final String PROPERTY_CONFIG_MSG = "esapi-java-logging.properties is no longer supported. See https://github.com/ESAPI/esapi-java-legacy/wiki/Configuring-the-JavaLogFactory for information on corrective actions.";
6161
/** Immune characters for the codec log scrubber for JAVA context.*/
6262
private static final char[] IMMUNE_JAVA_HTML = {',', '.', '-', '_', ' ' };
6363
/** Codec being used to clean messages for logging.*/
@@ -93,43 +93,24 @@ public class JavaLogFactory implements LogFactory {
9393

9494
LOG_BRIDGE = new JavaLogBridgeImpl(JAVA_LOG_APPENDER, JAVA_LOG_SCRUBBER, levelLookup);
9595

96-
readLoggerConfiguration(LogManager.getLogManager());
97-
}
98-
99-
/**
100-
* Attempts to load the expected property file path into the provided LogManager reference.
101-
* @param logManager LogManager which is being configured.
102-
*/
103-
/*package*/ static void readLoggerConfiguration(LogManager logManager) {
104-
if (System.getProperties().keySet().stream().anyMatch(propKey ->
105-
"java.util.logging.config.class".equals(propKey) || "java.util.logging.config.file".equals(propKey))) {
106-
// LogManager has external configuration. Do not load ESAPI defaults.
107-
// See javadoc for the LogManager class for more information on properties.
108-
boolean isStartupSysoutDisabled = Boolean.valueOf(System.getProperty(PropNames.DISCARD_LOGSPECIAL, Boolean.FALSE.toString()));
109-
if (!isStartupSysoutDisabled) {
110-
String logManagerPreferredMsg = String.format("[ESAPI-STARTUP] ESAPI JavaLogFactory Configuration will not be applied. "
111-
+ "java.util.LogManager configuration Detected. "
112-
+ "{\"java.util.logging.config.class\":\"%s\",\"java.util.logging.config.file\":\"%s\"}",
113-
System.getProperty("java.util.logging.config.class"), System.getProperty("java.util.logging.config.file"));
114-
115-
System.out.println(logManagerPreferredMsg);
116-
// ::SAMPLE OUTPUT::
117-
//[ESAPI-STARTUP] ESAPI JavaLogFactory Configuration will not be applied. java.util.LogManager configuration Detected.{"java.util.logging.config.class":"some.defined.value","java.util.logging.config.file":"null"}
118-
}
119-
120-
return;
121-
}
12296
/*
123-
* This will load the logging properties file to control the format of the output for Java logs.
97+
* esapi-java-logging.properties file may lead to confusing logging behavior
98+
* by overriding desired configurations provided through Java's LogManager class.
99+
*
100+
* Verify the file is not present and fail if found to enforce understanding of
101+
* the configuration method.
124102
*/
125103
try (InputStream stream = JavaLogFactory.class.getClassLoader().
126104
getResourceAsStream("esapi-java-logging.properties")) {
127-
if (stream == null) {
128-
throw new ConfigurationException("Unable to locate resource: esapi-java-logging.properties");
105+
if (stream != null) {
106+
throw new ConfigurationException(PROPERTY_CONFIG_MSG);
129107
}
130-
logManager.readConfiguration(stream);
108+
131109
} catch (IOException ioe) {
132-
throw new ConfigurationException("Failed to load esapi-java-logging.properties.", ioe);
110+
// This is a little strange, I know.
111+
// If the IOException is thrown, then the file actually exists but is malformatted or has some other issue.
112+
// The file should not exist at all, so use the same message as above but include the original exception in the log as well.
113+
throw new ConfigurationException(PROPERTY_CONFIG_MSG, ioe);
133114
}
134115
}
135116

‎src/test/java/org/owasp/esapi/logging/java/JavaLogFactoryTest.java

-82
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,8 @@
1414
*/
1515
package org.owasp.esapi.logging.java;
1616

17-
import java.io.IOException;
18-
import java.io.InputStream;
1917
import java.util.List;
20-
import java.util.logging.LogManager;
2118

22-
import org.hamcrest.CustomMatcher;
2319
import org.junit.Assert;
2420
import org.junit.Rule;
2521
import org.junit.Test;
@@ -28,7 +24,6 @@
2824
import org.junit.runner.RunWith;
2925
import org.mockito.ArgumentCaptor;
3026
import org.owasp.esapi.Logger;
31-
import org.owasp.esapi.errors.ConfigurationException;
3227
import org.owasp.esapi.logging.appender.LogAppender;
3328
import org.owasp.esapi.logging.appender.LogPrefixAppender;
3429
import org.owasp.esapi.logging.cleaning.CodecLogScrubber;
@@ -48,83 +43,6 @@ public class JavaLogFactoryTest {
4843
@Rule
4944
public ExpectedException exEx = ExpectedException.none();
5045

51-
@Test
52-
public void testLogManagerConfigurationAsClass() throws Exception {
53-
String propKey = "java.util.logging.config.class";
54-
//If defined, grab the value; otherwise, set to a known value to allow for prop to be cleared.
55-
String sysDefault = System.getProperties().stringPropertyNames().contains(propKey) ? System.getProperty(propKey) : testName.getMethodName();
56-
57-
System.setProperty(propKey, "some.defined.value");
58-
LogManager testLogManager = new LogManager() {
59-
@Override
60-
public void readConfiguration(InputStream ins) throws IOException, SecurityException {
61-
throw new IOException(testName.getMethodName());
62-
}
63-
};
64-
65-
try {
66-
// This would throw an IOException if the LogManager was not being respected since no esapi-java-logging file is specified
67-
JavaLogFactory.readLoggerConfiguration(testLogManager);
68-
} finally {
69-
//Restore original prop values
70-
if (testName.getMethodName().equals(sysDefault))
71-
System.clearProperty(propKey);
72-
else {
73-
System.setProperty(propKey, sysDefault);
74-
}
75-
}
76-
}
77-
78-
@Test
79-
public void testLogManagerConfigurationAsFile() throws Exception {
80-
String propKey = "java.util.logging.config.file";
81-
//If defined, grab the value; otherwise, set to a known value to allow for prop to be cleared.
82-
String sysDefault = System.getProperties().stringPropertyNames().contains(propKey) ? System.getProperty(propKey) : testName.getMethodName();
83-
84-
System.setProperty(propKey, "some.defined.value");
85-
LogManager testLogManager = new LogManager() {
86-
@Override
87-
public void readConfiguration(InputStream ins) throws IOException, SecurityException {
88-
throw new IOException(testName.getMethodName());
89-
}
90-
};
91-
92-
try {
93-
// This would throw an IOException if the LogManager was not being respected since no esapi-java-logging file is specified
94-
JavaLogFactory.readLoggerConfiguration(testLogManager);
95-
} finally {
96-
//Restore original prop values
97-
if (testName.getMethodName().equals(sysDefault)) {
98-
System.clearProperty(propKey);
99-
} else {
100-
System.setProperty(propKey, sysDefault);
101-
}
102-
}
103-
}
104-
@Test
105-
public void testConfigurationExceptionOnMissingConfiguration() throws Exception {
106-
final IOException originException = new IOException(testName.getMethodName());
107-
108-
LogManager testLogManager = new LogManager() {
109-
@Override
110-
public void readConfiguration(InputStream ins) throws IOException, SecurityException {
111-
throw originException;
112-
}
113-
};
114-
115-
exEx.expectMessage("Failed to load esapi-java-logging.properties");
116-
exEx.expect(ConfigurationException.class);
117-
118-
exEx.expectCause(new CustomMatcher<Throwable>("Check for IOException") {
119-
@Override
120-
public boolean matches(Object item) {
121-
return item instanceof IOException;
122-
}
123-
});
124-
125-
JavaLogFactory.readLoggerConfiguration(testLogManager);
126-
}
127-
12846
@Test
12947
public void testCreateLoggerByString() {
13048
Logger logger = new JavaLogFactory().getLogger("test");

‎src/test/resources/esapi-java-logging.properties

-6
This file was deleted.

0 commit comments

Comments
 (0)