...
Log messages with sensitive information should not be printed to the console display for security reasons (a possible example might be passenger age). The java.util.logging.Logger class supports different logging levels that can be used for classifying such information. These are FINEST, FINER, FINE, CONFIG, INFO, WARNING and SEVERE. By default, the INFO, WARNING and SEVERE levels print the message to the console, which is accessible by end users and system administrators.
This noncompliant code example assumes that the log message is not so sensitive as appear in other destinations, such as Assuming that the passenger age can appear in system log files , but is too sensitive to appear on a console displaynot on the console display, this code example is noncompliant.
| Code Block | ||
|---|---|---|
| ||
logger.info("Age: " + passengerAge);
|
...
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="445385da6f80cad5-68efa197-4b374216-9af7ac4b-57572b27712a61bb7b90855c"><ac:plain-text-body><![CDATA[ | [[MITRE 2009 | AA. Bibliography#MITRE 09]] | [CWE ID 532 | http://cwe.mitre.org/data/definitions/532.html] "Information Exposure Through Log Files" | ]]></ac:plain-text-body></ac:structured-macro> |
| CWE ID 533 "Information Exposure Through Server Log Files" | ||||
| CWE ID 359 "Privacy Violation" | ||||
| CWE ID 542 "Information Exposure Through Cleanup Log Files" |
...
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="81b67d98bbd61171-b9a4cb9c-45dc47b2-80fe894f-35236b7bc9ea6f8043e5d5d5"><ac:plain-text-body><![CDATA[ | [[API 2006 | AA. Bibliography#API 06]] | Class | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="07d7787f81589dca-4293a4ab-4afd4ec2-84cf8ab7-1a972f15c42e43346225140a"><ac:plain-text-body><![CDATA[ | [[Chess 2007 | AA. Bibliography#Chess 07]] | 11.1 Privacy and Regulation: Handling Private Information | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="fa45298a1ff9cc7d-709e571d-4f4f471a-bc599ce7-7212374d9db801ca822d98f9"><ac:plain-text-body><![CDATA[ | [[CVE 2008 | AA. Bibliography#CVE 08]] | [CVE-2005-2990 | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2990] | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="ff222d808f4192ff-5519f4f6-4e67412a-adf1b778-553d9a61cb671952064963cc"><ac:plain-text-body><![CDATA[ | [[Sun 2006 | AA. Bibliography#Sun 06]] | [Java Logging Overview | http://java.sun.com/javase/6/docs/technotes/guides/logging/overview.html] | ]]></ac:plain-text-body></ac:structured-macro> |
...