[英]How to avoid CRLF (Carriage Return and Line Feed) in Logback - CWE 117
I'm using Logback and I need to avoid CRLF(Carriage Return and Line Feed) when I log a user parameter.我正在使用 Logback,并且在记录用户参数时需要避免使用 CRLF(回车和换行)。
I tried to add my class, which extends ClassicConverter, on the static map PatternLayout.defaultConverterMap but It didn't work.我试图在静态地图 PatternLayout.defaultConverterMap 上添加我的类,它扩展了 ClassicConverter,但它没有用。
Thank you,谢谢,
You should create a custom layout as described in logback documentation您应该按照logback 文档中的描述创建自定义布局
Custom layout:自定义布局:
package com.foo.bar;
import ch.qos.logback.classic.PatternLayout;
import ch.qos.logback.classic.spi.ILoggingEvent;
public class RemoveCRLFLayout extends PatternLayout {
@Override
public String doLayout(ILoggingEvent event) {
return super.doLayout(event).replaceAll("(\\r|\\n)", "");
}
}
Logback configuration:登录配置:
<encoder class="ch.qos.logback.core.encoder.LayoutWrappingEncoder">
<layout class="com.foo.bar.RemoveCRLFLayout">
<pattern>%d %t %-5p %logger{16} - %m%n</pattern>
</layout>
</encoder>
ch.qos.logback.core.CoreConstants
; ch.qos.logback.core.CoreConstants
;
public static final String LINE_SEPARATOR = System.getProperty("line.separator");
ch.qos.logback.classic.pattern.LineSeparatorConverter
: ch.qos.logback.classic.pattern.LineSeparatorConverter
:
public String convert(ILoggingEvent event) {
return CoreConstants.LINE_SEPARATOR;
}
package ch.qos.logback.classic.PatternLayout
: package ch.qos.logback.classic.PatternLayout
:
defaultConverterMap.put("n", LineSeparatorConverter.class.getName());
So the proper way to ensure fixed line ending is the property line.separator
.所以确保固定行结束的正确方法是属性
line.separator
。
The same implementation is for java.lang.System.lineSeparator()
:相同的实现适用于
java.lang.System.lineSeparator()
:
lineSeparator = props.getProperty("line.separator");
For a quick solution we used a %replace
expression in our pattern, to replace line feed and carraige returns found in the message.为了快速解决问题,我们在模式中使用了
%replace
表达式来替换消息中的换行和回车。
Note this example is using a Spring Boot property to set the pattern, but you can use %replace in your Logback config file the same way.请注意,此示例使用 Spring Boot 属性来设置模式,但您可以以相同的方式在 Logback 配置文件中使用 %replace。
logging:
pattern:
console: "%d{yyyy-MM-dd HH:mm:ss.SSS} %-5level %logger - %replace(%msg){'\n|\r', '_'}%n"
(A custom converter would have been my first choice, but I had trouble getting it to work with Spring Boot and Spring Cloud Config. If you want to learn more about that approach, search the logback docs for conversionRule
.) (自定义转换器本来是我的首选,但我无法让它与 Spring Boot 和 Spring Cloud Config 一起使用。如果您想了解有关该方法的更多信息,请在 logback 文档中搜索
conversionRule
。)
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.