Poor Logging Practice - Revision history

Imifos: Moved page into the right category. See Java space page for me details. Content has not been reviewed in this edit.

2017-11-10T21:49:20Z

Moved page into the right category. See Java space page for me details. Content has not been reviewed in this edit.

Imifos: fixes classification

2015-12-01T11:51:25Z

fixes classification

KirstenS at 13:31, 27 February 2009

2009-02-27T13:31:50Z

KirstenS at 13:45, 19 February 2009

2009-02-19T13:45:30Z

KirstenS: /* References */

2009-02-18T00:13:38Z

‎References

KirstenS: /* Poor Logging Practice: Multiple Loggers */

2009-02-18T00:11:56Z

‎Poor Logging Practice: Multiple Loggers

KirstenS: /* Description */

2009-02-18T00:08:24Z

‎Description

KirstenS at 00:07, 18 February 2009

2009-02-18T00:07:02Z

KirstenS: Poor Logging Practice: Logger Not Declared Static Final moved to Poor Logging Practice

2009-02-18T00:05:49Z

Poor Logging Practice: Logger Not Declared Static Final moved to Poor Logging Practice

KirstenS at 14:58, 5 November 2008

2008-11-05T14:58:25Z

@@ Line 101: / Line 101: @@
 [[Category:OWASP ASDR Project]]
 [[Category:Code Quality Vulnerability]]
-[[Category:OWASP_Java_Project]]
+[[Category:Java]]
 [[Category:Implementation]]
 [[Category:Code Snippet]]
 [[Category:Logging and Auditing Vulnerability]]
 [[Category:Vulnerability]]

@@ Line 101: / Line 101: @@
 [[Category:OWASP ASDR Project]]
 [[Category:Code Quality Vulnerability]]
-[[Category:Java]]
+[[Category:OWASP_Java_Project]]
 [[Category:Implementation]]
 [[Category:Code Snippet]]
 [[Category:Logging and Auditing Vulnerability]]
 [[Category:Vulnerability]]

@@ Line 1: / Line 1: @@
 {{Template:Vulnerability}}
 {{Template:Fortify}}
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 ==Description==

@@ Line 2: / Line 2: @@
 {{Template:Fortify}}
-__TOC__
 [[ASDR Table of Contents]]

@@ Line 98: / Line 98: @@
 * http://www.link1.com
 * [http://www.link2.com Title for the link2]
 __NOTOC__
@@ Line 133: / Line 107: @@
 [[Category:Implementation]]
 [[Category:Code Snippet]]
-[[Category:Logging and Auditting Vulnerability]]
+[[Category:Logging and Auditing Vulnerability]]
 [[Category:Vulnerability]]

← Older revision		Revision as of 00:11, 18 February 2009
Line 42:		Line 42:

	</pre>		</pre>
		+
		+	===Use of a System Output Stream===
		+	Using System.out or System.err rather than a dedicated logging facility makes it difficult to monitor the behavior of the program. It can also cause log messages accidentally returned to the end users, revealing internal information to attackers.
		+
		+	The first Java program that a developer learns to write often looks like this:
		+
		+	<pre>
		+	public class MyClass
		+	public static void main(String[] args) {
		+	System.out.println("hello world");
		+	}
		+	}
		+	</pre>
		+
		+	While most programmers go on to learn many nuances and subtleties about Java, a surprising number hang on to this first lesson and never give up on writing messages to standard output using System.out.println().
		+
		+	The problem is that writing directly to standard output or standard error is often used as an unstructured form of logging. Structured logging facilities provide features like logging levels, uniform formatting, a logger identifier, timestamps, and, perhaps most critically, the ability to direct the log messages to the right place. When the use of system output streams is jumbled together with the code that uses loggers properly, the result is often a well-kept log that is missing critical information. In addition, using system output streams can also cause log messages accidentally returned to end users, revealing application internal information to attackers.
		+
		+	Developers widely accept the need for structured logging, but many continue to use system output streams in their "pre-production" development. If the code you are reviewing is past the initial phases of development, use of System.out or System.err may indicate an oversight in the move to a structured logging system.

	==Risk Factors==		==Risk Factors==

← Older revision		Revision as of 00:08, 18 February 2009
Line 23:		Line 23:
	</pre>		</pre>

		+	===Poor Logging Practice: Multiple Loggers===
		+	It is a poor logging practice to use multiple loggers rather than logging levels in a single class.

		+	Good logging practice dictates the use of a single logger that supports different logging levels for each class.

		+	The following code errantly declares multiple loggers.
		+
		+	<pre>
		+	public class MyClass {
		+	private final static Logger good =
		+	Logger.getLogger(MyClass.class);
		+	private final static Logger bad =
		+	Logger.getLogger(MyClass.class);
		+	private final static Logger ugly =
		+	Logger.getLogger(MyClass.class);
		+	...
		+	}
		+
		+	</pre>

	==Risk Factors==		==Risk Factors==

@@ Line 7: / Line 7: @@
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 ==Description==
 Loggers should be declared to be static and final.
 It is good programming practice to share a single logger object between all of the instances of a particular class and to use the same logger for the duration of the program.
@@ Line 24: / Line 31: @@
 ==Examples==

← Older revision	Revision as of 00:05, 18 February 2009
(No difference)