esapi-2.5.1.0 working fine without esapi-java-logging.properties in our product server but when running the product locally esapi asking for missing esapi-java-logging.properties

[SuganthVPM]

We have updated the esapi from 2.1.0.1 to 2.5.1.0, we adapted the ESAPI properties and left our the esapi-java-logging.properties file. Esapi is running fine on our server but when trying to run in a local development setup, esapi is saying that esapi-java-logging.properties file is missing.

Does the esapi take the server's logging properties instead of esapi-java-logging.properties and is this a desired behaviour?

@kwwall Could you please help me with this?

ESAPI: WARNING: System property [org.owasp.esapi.opsteam] is not set ESAPI: WARNING: System property [org.owasp.esapi.devteam] is not set ESAPI: Attempting to load ESAPI.properties via file I/O. ESAPI: Attempting to load ESAPI.properties as resource file via file I/O. ESAPI: Not found in 'org.owasp.esapi.resources' directory or file not readable: /home/suganth-18179/ESAPI.properties ESAPI: Not found in SystemResource Directory/resourceDirectory: .esapi/ESAPI.properties ESAPI: Not found in 'user.home' (/home/suganth-18179) directory: /home/suganth-18179/esapi/ESAPI.properties ESAPI: Loading ESAPI.properties via file I/O failed. Exception was: java.io.FileNotFoundException ESAPI: Attempting to load ESAPI.properties via the classpath. ESAPI: SUCCESSFULLY LOADED ESAPI.properties via the CLASSPATH from '/ (root)' using current thread context class loader! ESAPI: SecurityConfiguration for Validator.ConfigurationFile.MultiValued not found in ESAPI.properties. Using default: false ESAPI: Attempting to load validation.properties via file I/O. ESAPI: Attempting to load validation.properties as resource file via file I/O. ESAPI: Not found in 'org.owasp.esapi.resources' directory or file not readable: /home/suganth-18179/validation.properties ESAPI: Not found in SystemResource Directory/resourceDirectory: .esapi/validation.properties ESAPI: Not found in 'user.home' (/home/suganth-18179) directory: /home/suganth-18179/esapi/validation.properties ESAPI: Loading validation.properties via file I/O failed. ESAPI: Attempting to load validation.properties via the classpath. ESAPI: validation.properties could not be loaded by any means. fail.. Caught java.lang.IllegalArgumentException; exception message was: java.lang.IllegalArgumentException: Failed to load ESAPI.properties as a classloader resource. Dec 18, 2023 12:53:06 PM org.apache.catalina.core.StandardWrapperValve invoke SEVERE: Servlet.service() for servlet [nod.esapi.test.EsapiTestAPI] in context with path [/ESAPITest] threw exception [Servlet execution threw an exception] with root cause org.owasp.esapi.errors.ConfigurationException: Unable to locate resource: esapi-java-logging.properties at org.owasp.esapi.logging.java.JavaLogFactory.readLoggerConfiguration(JavaLogFactory.java:128) at org.owasp.esapi.logging.java.JavaLogFactory.<clinit>(JavaLogFactory.java:96) at java.base/java.lang.Class.forName0(Native Method) at java.base/java.lang.Class.forName(Class.java:375) at org.owasp.esapi.util.ObjFactory.loadClassByStringName(ObjFactory.java:158) at org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:81) at org.owasp.esapi.ESAPI.logFactory(ESAPI.java:139) at org.owasp.esapi.ESAPI.getLogger(ESAPI.java:155) at org.owasp.esapi.reference.DefaultEncoder.<init>(DefaultEncoder.java:85) at com.adventnet.iam.xss.IAMEncoder.<init>(IAMEncoder.java:65) at com.adventnet.iam.xss.IAMEncoder.encoder(IAMEncoder.java:47) at com.adventnet.iam.xss.IAMEncoder.encodeHTML(IAMEncoder.java:100)

[jeremiahjstacey]

The behavior you're seeing is correct.
It is possible that your server has the Java LogManager configuration set; which the JavaLogFactory does its best to respect.

https://github.com/ESAPI/esapi-java-legacy/blob/develop/src/main/java/org/owasp/esapi/logging/java/JavaLogFactory.java

• Lines 104 to 118
• As a part of Issue JavaLogFactory configuration should not override custom java LogManager configuration #710
  • 0df09e5

Other options may include:

• Your server is not using the JavaLogFactory and therefore does not require the properties file. SLF4JLogFactory?
• Your server is using the JavaLogFactory and does have the esapi-java-logging.properties file available, and that may need to be duplicated in development environments

[kwwall]

@BloodDrag0n - I think that @jeremiahjstacey covered almost everything, but I will add that you may find one or both of these wiki pages helpful:

• https://github.com/ESAPI/esapi-java-legacy/wiki/Configuration-Reference:-JavaLogFactory
• https://github.com/ESAPI/esapi-java-legacy/wiki/Using-ESAPI-with-SLF4J

[SuganthVPM]

Thank You @jeremiahjstacey and @kwwall for the explanation.