Logging is an important part of security measures taken by an organization. Log entries allow you to create automatic alert tools, gain statistics, or trace an attacker when there is a security breakdown. Log forging allows an attacker to manipulate log records by adding false entries. This may confuse automatic scanning utilities and allow attacks to happen unnoticed or allow attackers to misdirect the reviewer after an attack has happened.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Strings should be escaped for all characters that have special meaning for a particular log, for example CR for text log, or angle brackets for an XML log, and should be filtered for all non-text characters.

Example 1

14     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
15         String amount = req.getParameter("amount");
16         try {
17             int iAmount = Integer.parseInt(amount);
18             processAmount(iAmount);
19         } catch (NumberFormatException e) {
20             req.getSession().getServletContext().log("Incorrect int value specified for the 'amount' " + amount);
21         }
22     }

SV.LOG.FORGING is reported for line 20: Unvalidated user input is stored in 'amount' variable on line 15, and on line 20 it is concatenated with a constant string and written to log. This sequence makes log forging possible.

Security guidelines

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.