...
Logged information should be elided from the console display for security reasons (a possible example might be passenger age). The java.util.logging.Logger class supports different logging levels that can be used for classifying such information. These are FINEST, FINER, FINE, CONFIG, INFO, WARNING and SEVERE. All levels after and including The INFO, WARNING and SEVERE levels log the message to the console in addition to an external sourceend users (console) and system administrators.
| Code Block | ||
|---|---|---|
| ||
logger.info("Age: " + passengerAge);
|
...
Compliant Solution
This noncompliant code example logs at a level below INFO — FINEST, in this case — to prevent the passenger age from being displayed on the console. It also makes sure that such messages do not appear on the console. Thus the age is not actually logged.
...
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="c143bac959ed7227-00d2ed88-4f1f4edf-a35284a4-28e0fb748736204d3b1c0995"><ac:plain-text-body><![CDATA[ | [[MITRE 2009 | AA. Bibliography#MITRE 09]] | [CWE ID 532 | http://cwe.mitre.org/data/definitions/532.html] "Information Exposure Through Log Files" | ]]></ac:plain-text-body></ac:structured-macro> |
| CWE ID 533 "Information Exposure Through Server Log Files" | ||||
| CWE ID 359 "Privacy Violation" | ||||
| CWE ID 542 "Information Exposure Through Cleanup Log Files" |
...
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="df1f78dee53c5771-ca54d0d8-47254887-89cfb736-87ad60f7047d1ac3ad658814"><ac:plain-text-body><![CDATA[ | [[API 2006 | AA. Bibliography#API 06]] | Class | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="28d167ccbac2ccad-f66bffd0-422f466e-a3c1b7e8-837d8286a49c208251e94bcc"><ac:plain-text-body><![CDATA[ | [[Chess 2007 | AA. Bibliography#Chess 07]] | 11.1 Privacy and Regulation: Handling Private Information | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="e077207a69c55591-c8ff7e5f-4fe64793-b348948a-c04eaff140ec3e06236bdb76"><ac:plain-text-body><![CDATA[ | [[CVE 2008 | AA. Bibliography#CVE 08]] | [CVE-2005-2990 | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2990] | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="ff4c98a73f360bf8-cf1f2976-47614cac-bc2d8f37-1bffe150b8f7edf019a7c029"><ac:plain-text-body><![CDATA[ | [[Sun 2006 | AA. Bibliography#Sun 06]] | [Java Logging Overview | http://java.sun.com/javase/6/docs/technotes/guides/logging/overview.html] | ]]></ac:plain-text-body></ac:structured-macro> |
...