Error Handling - Revision history

EoinKeary at 11:51, 9 January 2007

2007-01-09T11:51:44Z

EoinKeary: /* Writing to the Event Log */

2007-01-09T11:46:01Z

‎Writing to the Event Log

EoinKeary: /* .NET */

2007-01-09T11:37:05Z

‎.NET

EoinKeary: /* Logging */

2007-01-09T11:17:53Z

‎Logging

EoinKeary: /* Centralised exception handling (Struts Example) */

2007-01-09T11:10:29Z

‎Centralised exception handling (Struts Example)

EoinKeary: /* Releasing resources and good housekeeping */

2007-01-09T11:10:11Z

‎Releasing resources and good housekeeping

EoinKeary: /* Try & Catch (Java/ .NET) */

2007-01-09T11:09:52Z

‎Try & Catch (Java/ .NET)

Eoin at 08:33, 9 June 2006

2006-06-09T08:33:11Z

Weilin Zhong: /* Page_Error */

2006-05-26T19:45:36Z

‎Page_Error

Weilin Zhong at 19:38, 26 May 2006

2006-05-26T19:38:37Z

Show changes

← Older revision		Revision as of 11:51, 9 January 2007
Line 256:		Line 256:
	</logic:messagePresent >		</logic:messagePresent >

−	~~==Logging==~~
−
−	Logging is the recording of information into storage that details who performed what and when they did it (like an audit trail) This can also cover debug messages implemented during development as well as any messages reflecting problems or states within the application. It should be an audit of everything that the business deems important to track about the applications use. Logging provides a detective method to ensure that the other security mechanisms being used are performing correctly.
−
−	~~Logging should be at least done at the following events:~~
−
−	~~Authentication: Successful & unsuccessful attempts.~~
−	~~Authorization requests.~~
−	~~Data manipulation: Any (CUD) Create, Update, Delete actions performed on the application.~~
−	~~Session activity: Termination/Logout events.~~
−
−	~~A good logging strategy should include the recording of any errors that occur in the application.~~
−	The application should have the ability to detect and record possible malicious use such as events that cause unexpected errors or defy the state model of the application. Users who attempt to get access to data that they shouldn’t, and incoming data that does not meet validation rules or has been tampered with. In general any error condition which could not occur without an attempt by the user to circumvent the application logic.
−
−	~~Logging should give us the information required to form a proper audit trail of a users actions.~~
−	~~Leading from this the date/time the actions were performed would be useful.~~
−	Logging functionality should not log a any personal or sensitive data pertaining to the user of function at hand that is being recorded; An example of this if your application is accepting HTTP GET the payload is in the URL and the GET shall be loged. This may result in logging sensitive data.
−
−	~~Logging should follow best practice regarding data validation; maximum length of information, malicious characters….~~
−	~~We should ensure that logging functionality only log’s messages of a reasonable length and that this length is enforced.~~
−
−	~~Common open source logging solutions:~~
−	~~Log4J: http://logging.apache.org/log4j/docs/index.html~~
−
−	~~Log4net: http://logging.apache.org/log4net/~~
−
−	~~Commons Logging: http://jakarta.apache.org/commons/logging/index.html~~
−
−	~~In Tomcat(5.5), if no custom logger is defined (log4J) then everything is logged via Commons Logging and ultimately ends up in catalina.out.~~
−	catalina.out grows endlessly and does not recycle/rollover. Log4J provides “Rollover” functionality, which limits the size of the log. Log4J also gives the option to specify “appenders” which can redirect the log data to other destinations such as a port, syslog or even a database or JMS.
−
−	~~The parts of log4J which should be considered apart from the actual data being logged by the application are contained in the log4j.properties file:~~
−
−	#
−	~~# Configures Log4j as the Tomcat system logger~~
−	#
−
−	#
−	~~# Configure the logger to output info level messages into a rolling log file.~~
−	#
−	~~log4j.rootLogger=INFO, R~~
−
−	#
−	~~# To continue using the "catalina.out" file (which grows forever),~~
−	~~# comment out the above line and uncomment the next.~~
−	#
−	~~#log4j.rootLogger=ERROR, A1~~
−
−	#
−	~~# Configuration for standard output ("catalina.out").~~
−	#
−	~~log4j.appender.A1=org.apache.log4j.ConsoleAppender~~
−	~~log4j.appender.A1.layout=org.apache.log4j.PatternLayout~~
−	#
−	~~# Print the date in ISO 8601 format~~
−	#
−	~~log4j.appender.A1.layout.ConversionPattern=%d [%t] %-5p %c - %m%n~~
−
−	#
−	~~# Configuration for a rolling log file ("tomcat.log").~~
−	#
−	~~log4j.appender.R=org.apache.log4j.DailyRollingFileAppender~~
−	~~log4j.appender.R.DatePattern='.'yyyy-MM-dd~~
−	#
−	~~# Edit the next line to point to your logs directory.~~
−	~~# The last part of the name is the log file name.~~
−	#
−	~~log4j.appender.R.File=/usr/local/tomcat/logs/tomcat.log~~
−	~~log4j.appender.R.layout=org.apache.log4j.PatternLayout~~
−	#
−	~~# Print the date in ISO 8601 format~~
−	#
−	~~log4j.appender.R.layout.ConversionPattern=%d [%t] %-5p %c - %m%n~~
−
−	#
−	~~# Application logging options~~
−	#
−	~~#log4j.logger.org.apache=DEBUG~~
−	~~#log4j.logger.org.apache=INFO~~
−	~~#log4j.logger.org.apache.struts=DEBUG~~
−	~~#log4j.logger.org.apache.struts=INFO~~
−
−	~~=== Vulnerable patterns examples for Logging===~~
−
−	~~====.NET====~~
−	~~The following are issues one may look out for or question the development team /deployment team.~~
−	~~Logging and auditing are detective methods of fraud prevention. Much overlooked in the industry, which enables attackers to continue to attack/commit fraud without being detected.~~
−
−	~~They cover Windows and .NET issues:~~
−	~~'''Check that:'''~~
−	~~#Windows native log puts a timestamp on all log entries.~~
−	~~#GMT is set as the default time.~~
−	~~#The Windows operating system can be configured to use network timeservers.~~
−	#By default the event log will show: Name of the computer that generated the event; The application in the source field of the viewer. Additional information such as request identifier,username,and destination should be included in the body of the error event.
−	~~#No sensitive or business critical information is sent to the application logs.~~
−	~~#Application logs are not located in the web root directory.~~
−	~~#Log policy allows different levels of log severity.~~
−
−	~~===== Writing to the Event Log=====~~
−	~~In the course of reviewing .NET code ensure that calls the EventLog object do not provide any confidential information.~~
−
−
−	~~EventLog.WriteEntry( "<password>",EventLogEntryType.Information);~~
−
−	~~====JAVA====~~

	[[Category:OWASP Code Review Project]]		[[Category:OWASP Code Review Project]]

@@ Line 358: / Line 358: @@
-  EventLog.WriteEntry( "MySource",EventLogEntryType.Information);
+  EventLog.WriteEntry( "<password>",EventLogEntryType.Information);
 ====JAVA====
 [[Category:OWASP Code Review Project]]

@@ Line 341: / Line 341: @@
 ====.NET====
 ====JAVA====
 [[Category:OWASP Code Review Project]]

← Older revision		Revision as of 11:17, 9 January 2007
Line 338:		Line 338:
	#log4j.logger.org.apache.struts=INFO		#log4j.logger.org.apache.struts=INFO

		+	=== Vulnerable patterns examples for Logging===
		+
		+	====.NET====
		+
		+	====JAVA====

	[[Category:OWASP Code Review Project]]		[[Category:OWASP Code Review Project]]

@@ Line 228: / Line 228: @@
 A Java example showing finally() being used to release system resources.
-==Centralised exception handling (Struts Example)==
+===Centralised exception handling (Struts Example)===
 Building an infrastructure for consistent error reporting proves more difficult than error handling.
@@ Line 255: / Line 255: @@
   </html:messages>
   </logic:messagePresent >
-−
 ==Logging==

@@ Line 204: / Line 204: @@
 In general, it is best practice to catch a specific type of exception rather than use the basic catch(Exception) or catch(Throwable) statement in the case of Java.
-==Releasing resources and good housekeeping==
+===Releasing resources and good housekeeping===
 If the language in question has a finally method use it. The finally method is guaranteed to always be called. The finally method can be used to release resources referenced by the method that threw the exception. This is very important. An example would be if a method gained a database connection from a pool of connections and an exception occurred without finally the connection object shall not be returned to the pool for some time (until the timeout). This can lead to pool exhaustion. finally() is called even if no exception is thrown.
@@ Line 227: / Line 227: @@
 A Java example showing finally() being used to release system resources.
 ==Centralised exception handling (Struts Example)==

@@ Line 160: / Line 160: @@
-==Try & Catch (Java/ .NET)==
+== Best Practices for Error Handling ==
 Code that might throw exceptions should be in a try block and code that handles exceptions in a catch block.
@@ Line 201: / Line 204: @@
 In general, it is best practice to catch a specific type of exception rather than use the basic catch(Exception) or catch(Throwable) statement in the case of Java.
 ==Releasing resources and good housekeeping==

@@ Line 1: / Line 1: @@
 [[OWASP Code Review Guide Table of Contents]]__TOC__
 ==Error, Exception handling & Logging. ==
-Contact author: [mailto:eoinkeary@hotmail.com Eoin Keary]
+Contact author: [mailto:eoinkeary@owasp.org Eoin Keary]
 An important aspect of secure application development is to prevent information leakage. Error messages give an attacker great insight into the inner workings of an application.

@@ Line 91: / Line 91: @@
 Below is an example but the error information is a little too informative and hence bad practice.
- <script language="C#" runat="server">
+'''FIXME: code formatting'''
- Sub Page_Error(Source As Object, E As EventArgs)
-     Dim message As String = "<font face=verdana color=red>"
+<nowiki>
-                            & "<h1>" & Request.Url.ToString() & "</h1>"
-                            & "<pre><font color='red'>" & Server.GetLastError().ToString() & "</pre>" & "</font>"
+<script language="C#" runat="server">
-     Response.Write(message) // display message
- End Sub
+Sub Page_Error(Source As Object, E As EventArgs)
- </script>
 The red text in the example above has a number of issues: