Injection Prevention Cheat Sheet in Java - Revision history

Dominique RIGHETTO: Point to the official site

2019-07-15T14:12:11Z

Point to the official site

Thunder-Son: Migration to GitHub

2019-02-14T11:51:30Z

Migration to GitHub

Show changes

Dominique RIGHETTO: Remove XXE section according to Katy Anton request

2018-11-28T12:01:05Z

Remove XXE section according to Katy Anton request

Dominique RIGHETTO: Add notice about XXE

2018-11-27T17:09:05Z

Add notice about XXE

Wichers: /* Log Injection */

2018-11-26T17:41:39Z

‎Log Injection

Dominique RIGHETTO: Add owasp-security-logging dependency info

2018-11-26T17:30:18Z

Add owasp-security-logging dependency info

Dominique RIGHETTO: Add logback reference to use with owasp-security-logging

2018-11-26T17:28:01Z

Add logback reference to use with owasp-security-logging

Dominique RIGHETTO: Fix typo in loback config

2018-11-26T17:24:37Z

Fix typo in loback config

Dominique RIGHETTO: Add logback example

2018-11-26T17:09:44Z

Add logback example

Dominique RIGHETTO: Add logback example

2018-11-26T17:07:47Z

Add logback example

← Older revision		Revision as of 14:12, 15 July 2019
Line 4:		Line 4:
	The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!		The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!

−	Please visit [https://~~github~~.~~com/OWASP/CheatSheetSeries/blob/master~~/cheatsheets/Injection_Prevention_Cheat_Sheet_in_Java.md Injection Prevention Cheat Sheet in Java] to see the latest version of the cheat sheet.	+	Please visit [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet_in_Java.html Injection Prevention Cheat Sheet in Java] to see the latest version of the cheat sheet.

← Older revision		Revision as of 12:01, 28 November 2018
Line 167:		Line 167:

	* [[Command_Injection\|Command Injection]]		* [[Command_Injection\|Command Injection]]
−
−	~~== XML: External Entity attack ==~~
−
−	~~<code>~~
−	~~XXE is not considered an Injection issue anymore by the [https://github.com/OWASP/Top10/issues/176 OWASP TOP 10].~~
−
−	~~However, we keep the prevention code about XXE here in order to provide usable hint about the XXE issue.~~
−
−	~~A dedicated [[XML External Entity (XXE) Prevention Cheat Sheet\|XXE cheat sheet]] exists.~~
−	~~</code>~~
−
−	~~=== Symptom ===~~
−
−	~~Injection of this type occur when the application load the received XML stream using a XML parser instance in which the resolution of External Entity is not disabled.~~
−
−	~~=== How to prevent ===~~
−
−	~~Disable to resolution of the External Entity in the parser instance to prevent injection.~~
−
−	~~=== Example ===~~
−
−	~~<syntaxhighlight lang="java">~~
−	~~/Create a XML document builder factory/~~
−	~~DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();~~
−
−	~~/Disable External Entity resolution for differents cases/~~
−	~~// This is the PRIMARY defense. If DTDs (doctypes) are disallowed,~~
−	~~// almost all XML entity attacks are prevented~~
−	~~// Xerces 2 only - http://xerces.apache.org/xerces2-j/features.html#disallow-doctype-decl~~
−	~~String feature = "http://apache.org/xml/features/disallow-doctype-decl";~~
−	~~dbf.setFeature(feature, true);~~
−
−	~~// If you can't completely disable DTDs, then at least do the following:~~
−	~~// Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-general-entities~~
−	~~// Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-general-entities~~
−	~~// JDK7+ - http://xml.org/sax/features/external-general-entities~~
−	~~feature = "http://xml.org/sax/features/external-general-entities";~~
−	~~dbf.setFeature(feature, false);~~
−
−	~~// Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-parameter-entities~~
−	~~// Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-parameter-entities~~
−	~~// JDK7+ - http://xml.org/sax/features/external-parameter-entities~~
−	~~feature = "http://xml.org/sax/features/external-parameter-entities";~~
−	~~dbf.setFeature(feature, false);~~
−
−	~~// feature external DTDs as well~~
−	~~feature = "http://apache.org/xml/features/nonvalidating/load-external-dtd";~~
−	~~dbf.setFeature(feature, false);~~
−
−	~~// and these as well, per Timothy Morgan's 2014 paper: "XML Schema, DTD, and Entity Attacks"~~
−	~~dbf.setXIncludeAware(false);~~
−	~~dbf.setExpandEntityReferences(false);~~
−
−	~~/Load XML file/~~
−	~~DocumentBuilder builder = dbf.newDocumentBuilder();~~
−	~~//Here an org.xml.sax.SAXParseException will be throws because the XML contains a External Entity.~~
−	~~builder.parse(new File("src/test/resources/SampleXXE.xml"));~~
−	~~</syntaxhighlight>~~

	== XML: XPath Injection ==		== XML: XPath Injection ==

← Older revision		Revision as of 17:09, 27 November 2018
Line 169:		Line 169:

	== XML: External Entity attack ==		== XML: External Entity attack ==
		+
		+	<code>
		+	XXE is not considered an Injection issue anymore by the [https://github.com/OWASP/Top10/issues/176 OWASP TOP 10].
		+
		+	However, we keep the prevention code about XXE here in order to provide usable hint about the XXE issue.
		+
		+	A dedicated [[XML External Entity (XXE) Prevention Cheat Sheet\|XXE cheat sheet]] exists.
		+	</code>

	=== Symptom ===		=== Symptom ===

@@ Line 434: / Line 434: @@
 == Log Injection ==
 === Symptom ===
-[[Log_Injection|Log Injection]] occurs when an application includes untrusted data in an application log message (e.g., an attacker can cause an additional log entry that looks like it came from a completely different user, if they can inject CRLF characters in the untrusted data).
+[[Log_Injection|Log Injection]] occurs when an application includes untrusted data in an application log message (e.g., an attacker can cause an additional log entry that looks like it came from a completely different user, if they can inject CRLF characters in the untrusted data). More information about this attack is available on the OWASP [[Log Injection]] page.
 === How to prevent ===
@@ Line 490: / Line 486: @@
 </syntaxhighlight>
-=== Example using Logback along the OWASP Security Logging project ===
+=== Example using Logback with the OWASP Security Logging library ===
-Configuration of a logging policy to roll on 10 files of 5MB each, and encode/limit the log message using the [https://github.com/javabeanz/owasp-security-logging/wiki/Log-Forging CRLFConverter], provided by the OWASP Security Logging project, and the ''-500msg'' message size limit (add the [https://github.com/javabeanz/owasp-security-logging/wiki/Usage-with-Logback OWASP Security Logging] dependency in your project):
+Configuration of a logging policy to roll on 10 files of 5MB each, and encode/limit the log message using the [https://github.com/javabeanz/owasp-security-logging/wiki/Log-Forging CRLFConverter], provided by the [[OWASP Security Logging Project]], and the ''-500msg'' message size limit:
 <syntaxhighlight lang="xml" highlight="4,17">
@@ Line 519: / Line 515: @@
 </configuration>
 </syntaxhighlight>
 Usage of the logger at code level:
@@ Line 543: / Line 541: @@
 https://logging.apache.org/log4j/2.x/manual/appenders.html
-https://github.com/javabeanz/owasp-security-logging/wiki/Log-Forging (See the Logback section about the CRLFConverter)
+https://github.com/javabeanz/owasp-security-logging/wiki/Log-Forging - See the Logback section about the CRLFConverter this library provides.
 https://github.com/javabeanz/owasp-security-logging/wiki/Usage-with-Logback

@@ Line 492: / Line 492: @@
 === Example using Logback along the OWASP Security Logging project ===
-Configuration of a logging policy to roll on 10 files of 5MB each, and encode/limit the log message using the [https://github.com/javabeanz/owasp-security-logging/wiki/Log-Forging CRLFConverter], provided by the OWASP Security Logging project, and the ''-500msg'' message size limit:
+Configuration of a logging policy to roll on 10 files of 5MB each, and encode/limit the log message using the [https://github.com/javabeanz/owasp-security-logging/wiki/Log-Forging CRLFConverter], provided by the OWASP Security Logging project, and the ''-500msg'' message size limit (add the [https://github.com/javabeanz/owasp-security-logging/wiki/Usage-with-Logback OWASP Security Logging] dependency in your project):
 <syntaxhighlight lang="xml" highlight="4,17">

@@ Line 547: / Line 547: @@
 Logback does not have a built-in CRLF encoder, so the library provides the CRLFConverter class.
 </pre>
 = Authors and Primary Editors  =

@@ Line 494: / Line 494: @@
 Configuration of a logging policy to roll on 10 files of 5MB each, and encode/limit the log message using the [https://github.com/javabeanz/owasp-security-logging/wiki/Log-Forging CRLFConverter], provided by the OWASP Security Logging project, and the ''-500msg'' message size limit:
-<syntaxhighlight lang="xml" highlight="14,17">
+<syntaxhighlight lang="xml" highlight="4,17">
 <?xml version="1.0" encoding="UTF-8"?>
 <configuration>
-   <appender name="RollingFile" class="ch.qos.logback.core.rolling.RollingFileAppender">
+    <!-- Define the CRLFConverter -->
-      <file>App.log</file>
+    <conversionRule conversionWord="crlf" converterClass="org.owasp.security.logging.mask.CRLFConverter" />
-      <rollingPolicy class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
+    <appender name="RollingFile" class="ch.qos.logback.core.rolling.RollingFileAppender">
-         <fileNamePattern>App-%i.log</fileNamePattern>
+        <file>App.log</file>
-         <minIndex>1</minIndex>
+        <rollingPolicy class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
-         <maxIndex>10</maxIndex>
+            <fileNamePattern>App-%i.log</fileNamePattern>
-      </rollingPolicy>
+            <minIndex>1</minIndex>
-      <triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
+            <maxIndex>10</maxIndex>
-         <maxFileSize>5MB</maxFileSize>
+        </rollingPolicy>
-      </triggeringPolicy>
+        <triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
-      <!-- Define the CRLFConverter -->
+            <maxFileSize>5MB</maxFileSize>
-      <conversionRule conversionWord="crlf" converterClass="org.owasp.security.logging.mask.CRLFConverter" />
+        </triggeringPolicy>
-      <encoder>
+        <encoder>
-         <!-- Encode any CRLF chars in the message and limit its maximum size to 500 characters -->
+            <!-- Encode any CRLF chars in the message and limit its maximum size to 500 characters -->
-         <pattern>%relative [%thread] %-5level %logger{35} - %crlf(%.-500msg) %n</pattern>
+            <pattern>%relative [%thread] %-5level %logger{35} - %crlf(%.-500msg) %n</pattern>
-      </encoder>
+        </encoder>
-   </appender>
+    </appender>
-   <root level="debug">
+    <root level="debug">
-      <appender-ref ref="RollingFile" />
+        <appender-ref ref="RollingFile" />
-   </root>
+    </root>
 </configuration>
 </syntaxhighlight>

@@ Line 535: / Line 535: @@
 https://logging.apache.org/log4j/2.x/manual/layouts.html#PatternLayout (See the encode{}{CRLF} function)
- Note that the default Log4j2 encode{} encoder is HTML, which does NOT prevent log injection. It prevents XSS attacks against viewing logs using a browser. OWASP recommends defending against XSS attacks in such situations in the log viewer application itself, not by preencoding all the log messages with HTML encoding as such log entries may be used/viewed in many other log viewing/analysis tools that don't expect the log data to be pre-HTML encoded.
+<pre>
 https://logging.apache.org/log4j/2.x/manual/configuration.html
@@ Line 542: / Line 544: @@
 https://github.com/javabeanz/owasp-security-logging/wiki/Log-Forging (See the Logback section about the CRLFConverter)
 = Authors and Primary Editors  =

@@ Line 486: / Line 486: @@
 // No special action needed because security actions are performed at the logging policy level
 Logger logger = LogManager.getLogger(MyClass.class);
 logger.info(logMessage);
 ...
@@ Line 498: / Line 540: @@
 https://logging.apache.org/log4j/2.x/manual/appenders.html
 = Authors and Primary Editors  =