Skip to main content
Level 4
May 5, 2023
Beantwortet

Change this code to not log user-controlled data.

  • May 5, 2023
  • 1 Antwort
  • 7027 Ansichten

On logs as mentioned below, SonarQube throws an issue stating 'Change this code to not log user-controlled data.'

 

LOGGER.error("Unable to adapt resource at path {} to a Page object",
rootPagePath);
 
Why is this an issue?
Dieses Thema wurde für Antworten geschlossen.
Beste Antwort von MayurSatav

Hi @goyalkritika,

 

Logging user-controlled data considered a security vulnerability. Attackers can manipulate user-controlled data to inject malicious code or exploit application vulnerabilities. In this case, the rootPagePath parameter is logged with the error message. If an attacker is able to control the value of rootPagePath, they can use it to inject their own code or perform other attacks on the application. This problem can be fixed by removing user-controlled data logging from the code.

1 Antwort

MayurSatav
Community Advisor
MayurSatavCommunity AdvisorAntwort
Community Advisor
May 5, 2023

Hi @goyalkritika,

 

Logging user-controlled data considered a security vulnerability. Attackers can manipulate user-controlled data to inject malicious code or exploit application vulnerabilities. In this case, the rootPagePath parameter is logged with the error message. If an attacker is able to control the value of rootPagePath, they can use it to inject their own code or perform other attacks on the application. This problem can be fixed by removing user-controlled data logging from the code.

Mayur Satav | www.mayursatav.in