Page History

...

This noncompliant code example uses statements that can throw exceptions when logging is in process. It attempts to log a security exception SecurityException generated within the run method, however, the original log message is not logged if an exception is thrown during the logging process. An exception is thrown if there is a problem with the application's file system or if a thread attempts to write to the log file when the file is locked by another thread. An attacker can exploit these problems by:

Gaining access to the application's file system and deleting or changing the permissions of the log file.
Exploiting the multi-threaded nature of the application by providing input to the application via normal input channels that results in log messages being lost due to an OverlappingFileLockException. Because this attack vector makes use of standard input channels to perform the attack, it is much simpler to implement than the previous attack, which requires access to the application's file system.

Code Block

bgColor	#FFcccc


import java.io.FileOutputStream;
import java.nio.channels.FileLock;
import java.nio.channels.OverlappingFileLockException;
import java.io.BufferedWriter;
import java.io.IOException;
import java.io.FileNotFoundException;

public class ExceptionLog implements Runnable {

    public void logMessage(String message) {

        FileOutputStream fo = null;
        FileLock lock = null;
    
    try {
            // This can throw an exception and prevent logging.
            fo = new FileOutputStream("log_file.txt", true); 

            // Lock the file so only one thread can write a log
            // message at a time.
            lock = fo.getChannel().lock();

            // Output the log message.
            System.err.println(message);
            fo.write((message + "\n").getBytes());
        } 

        // If an exception is caught, the original message to log is
        // lost.
        catch (FileNotFoundException e){
            logMessage("File Not Found Exception."); 
        }
        catch(IOException e) {
            logMessage("IO Exception."); 
        }
        catch (OverlappingFileLockException e) {
            logMessage("Cannot access file.");
        }
        finally {

            // Clean up by releasing the file lock and closing the
            // file.
            try {
                if (lock != null) {
                    lock.release();
                }
        
        if (fo != null) {
                    fo.close();
                }
            }
            catch (IOException e) {
                // This is unexpected.
                throw new RuntimeException(e);
            }
        }
    }

    public void run() {
        // ...
  try {
      // Some security exception occurs here.
    } catch(SecurityException se) {
        logMessage("Security Exception has occurred!");
        // ...
  }
  }

    public static void main(String[] args) {

        // Start multiple threads logging messages.
        for (int x=1; x<=20; x++) {
            (new Thread(new ExceptionLog())).start();
        }
    }    
}

Compliant Solution

This compliant solution executes several statements that can possibly throw exceptions prior to performing any security critical operations and uses the thread and exception safe Java Logger class to implement logging. As a result, exceptions do not result in failure to log a message or a different message than intended being logged. While this is a stringent requirement, it is necessary in cases where an exception can be deliberately thrown to conceal an attacker's tracks. The logging mechanism must be robust and should be able to detect and handle such phenomena.

Code Block

bgColor	#ccccff


import java.io.IOException;
import java.util.logging.FileHandler;
import java.util.logging.Level;
import java.util.logging.Logger;
import java.util.logging.SimpleFormatter;
import java.io.File;

public class ExceptionLog1ExceptionLog implements Runnable {

    Logger logger;
    Integer id;

    public ExceptionLog1ExceptionLog(Integer i, Logger l) {
        logger = l;
        id = i;
    }

    public void logMessage(String message) {
        // Note that the Java Logger class does not throw exceptions
        // while logging a message.
        logger.log(Level.WARNING, "From " + id + ": " + message);
    }

    public void run() {
        // ...try {
        // Some security exception occurs here.
    } catch(SecurityException se) {
        logMessage("Security Exception has occurred!");
        // ...
  }
  }

    public static void main(String[] args) {

        try {

            // Set up the shared logger for use by the multiple
            // threads.
            Logger logger = Logger.getLogger("MyLog");
            FileHandler fh = new FileHandler("log_file1file.txt", true);
            logger.addHandler(fh);
            logger.setLevel(Level.ALL);
            SimpleFormatter formatter = new SimpleFormatter();
            fh.setFormatter(formatter);

            // Start multiple threads for logging messages.
            for (int x=1; x<=20; x++) {
                (new Thread(new ExceptionLog1ExceptionLog(x, logger))).start();
            }
        }
        catch (SecurityException e) {
            // This is unexpected.
            throw new RuntimeException(e);
        } 
        catch (IOException e) {
            // This is unexpected.
            throw new RuntimeException(e);
        }
    }    
}

A slightly more expensive alternative is to support recursive logging.

...

Space shortcuts

Page tree

Versions Compared

Old Version 28

New Version 29

Key

Compliant Solution