...
This compliant solution just validates the username input before logging it, preventing injection attacks. Refer to IDS00-J. Sanitize untrusted data passed across a trust boundary for more details on input sanitization.
| Code Block | ||
|---|---|---|
| ||
if (!Pattern.matches("[A-Za-z0-9_]+", username)) {
// Unsanitized username
logger.severe("User login failed for unauthorized user");
} else if (loginSuccessful) {
logger.severe("User login succeeded for: " + username);
} else {
logger.severe("User login failed for: " + username);
}
|
...