logging - Sonar 问题 : Make sure that this logger's configuration is safe

Question

我在 Sonar 上的代码出现以下问题:

Make sure that this logger's configuration is safe.

我写的代码是:

public static final Logger logger = Logger.getLogger("logger");
if (logLevel.equalsIgnoreCase("info"))
    logger.setLevel(Level.INFO);
else
    logger.setLevel(Level.ALL);

它在 logger.setLevel 上向我显示此错误调用。

我该如何解决这些问题？

Answer 1

根据 SonarQube rules , 此规则标记用于启动记录器配置的审查代码。

目标是指导安全代码审查。此外，没有办法通过代码修复它，而您应该问自己是否:

• unauthorized users might have access to the logs, either because they are stored in an insecure location or because the application gives access to them.
• the logs contain sensitive information on a production server. This can happen when the logger is in debug mode.
• the log can grow without limit. This can happen when additional information is written into logs every time a user performs an action and the user can perform the action as many times as he/she wants.
• the logs do not contain enough information to understand the damage an attacker might have inflicted. The loggers mode (info, warn, error) might filter out important information. They might not print contextual information like the precise time of events or the server hostname.
• the logs are only stored locally instead of being backuped or replicated.

You are at risk if you answered yes to any of those questions.

有关安全日志记录项目的更多信息，请查看 owasp page