Skip to content

Commit 05a3ce2

Browse files
author
planetlevel
committed
make ref impls equivalent and fix a possible npe
1 parent 33166b1 commit 05a3ce2

2 files changed

Lines changed: 39 additions & 24 deletions

File tree

‎src/main/java/org/owasp/esapi/reference/JavaLogFactory.java‎

Lines changed: 23 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -316,17 +316,29 @@ private void log(Level level, EventType type, String message, Throwable throwabl
316316
clean += " (Encoded)";
317317
}
318318
}
319-
320-
// create the message to log
321-
String msg = "";
322-
if ( user != null ) {
323-
msg = type + "-" + (type.isSuccess() ? "SUCCESS" : "FAILURE" ) + " " + user.getAccountName() + "@"+ user.getLastHostAddress() +":" + userSessionIDforLogging + " -- " + clean;
324-
}
325-
if(throwable == null) {
326-
jlogger.logp(level, applicationName, moduleName, msg);
327-
} else {
328-
jlogger.logp(level, applicationName, moduleName, msg, throwable);
329-
}
319+
320+
// create the message to log
321+
String msg = "";
322+
if ( user != null && type != null) {
323+
msg = type + " " + user.getAccountName()+ ":" + user.getAccountId() + "@"+ user.getLastHostAddress() +":" + userSessionIDforLogging + " " + clean;
324+
}
325+
326+
boolean logAppName = ((DefaultSecurityConfiguration)ESAPI.securityConfiguration()).getLogApplicationName();
327+
boolean logServerIP = ((DefaultSecurityConfiguration)ESAPI.securityConfiguration()).getLogServerIP();
328+
329+
if (!logServerIP || ESAPI.currentRequest() == null ) {
330+
if (logAppName) {
331+
jlogger.log(level, applicationName + " " + moduleName + " " + msg, throwable);
332+
} else { //!logAppName
333+
jlogger.log(level, moduleName + " " + msg, throwable);
334+
}
335+
} else { //logServerIP
336+
if (logAppName && ESAPI.currentRequest() != null ) {
337+
jlogger.log(level, applicationName + ":" + ESAPI.currentRequest().getServerName() + ":" + ESAPI.currentRequest().getLocalPort() + " " + moduleName + " " + msg, throwable);
338+
} else { //!logAppName
339+
jlogger.log(level, ESAPI.currentRequest().getServerName() + ":" + ESAPI.currentRequest().getLocalPort() + " " +moduleName + " " + msg, throwable);
340+
}
341+
}
330342
}
331343

332344
/**

‎src/main/java/org/owasp/esapi/reference/Log4JLogFactory.java‎

Lines changed: 16 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,11 @@
11
package org.owasp.esapi.reference;
22

33
import java.util.HashMap;
4-
import org.apache.log4j.Level;
54

5+
import javax.servlet.http.HttpServletRequest;
66
import javax.servlet.http.HttpSession;
77

8+
import org.apache.log4j.Level;
89
import org.owasp.esapi.ESAPI;
910
import org.owasp.esapi.LogFactory;
1011
import org.owasp.esapi.Logger;
@@ -265,16 +266,18 @@ private void log(Level level, EventType type, String message, Throwable throwabl
265266
// create a random session number for the user to represent the user's 'session', if it doesn't exist already
266267
String userSessionIDforLogging = "unknown";
267268

268-
try {
269-
HttpSession session = ESAPI.httpUtilities().getCurrentRequest().getSession( false );
270-
userSessionIDforLogging = (String)session.getAttribute("ESAPI_SESSION");
271-
// if there is no session ID for the user yet, we create one and store it in the user's session
272-
if ( userSessionIDforLogging == null ) {
273-
userSessionIDforLogging = ""+ ESAPI.randomizer().getRandomInteger(0, 1000000);
274-
session.setAttribute("ESAPI_SESSION", userSessionIDforLogging);
275-
}
276-
} catch( NullPointerException e ) {
277-
// continue
269+
// add a session token to log if there is an HTTP session
270+
HttpServletRequest request = ESAPI.httpUtilities().getCurrentRequest();
271+
if ( request != null ) {
272+
HttpSession session = request.getSession( false );
273+
if ( session != null ) {
274+
userSessionIDforLogging = (String)session.getAttribute("ESAPI_SESSION");
275+
// if there is no session ID for the user yet, we create one and store it in the user's session
276+
if ( userSessionIDforLogging == null ) {
277+
userSessionIDforLogging = ""+ ESAPI.randomizer().getRandomInteger(0, 1000000);
278+
session.setAttribute("ESAPI_SESSION", userSessionIDforLogging);
279+
}
280+
}
278281
}
279282

280283
// ensure there's something to log
@@ -300,14 +303,14 @@ private void log(Level level, EventType type, String message, Throwable throwabl
300303
boolean logAppName = ((DefaultSecurityConfiguration)ESAPI.securityConfiguration()).getLogApplicationName();
301304
boolean logServerIP = ((DefaultSecurityConfiguration)ESAPI.securityConfiguration()).getLogServerIP();
302305

303-
if (!logServerIP) {
306+
if (!logServerIP || ESAPI.currentRequest() == null ) {
304307
if (logAppName) {
305308
jlogger.log(level, applicationName + " " + moduleName + " " + msg, throwable);
306309
} else { //!logAppName
307310
jlogger.log(level, moduleName + " " + msg, throwable);
308311
}
309312
} else { //logServerIP
310-
if (logAppName) {
313+
if (logAppName && ESAPI.currentRequest() != null ) {
311314
jlogger.log(level, applicationName + ":" + ESAPI.currentRequest().getServerName() + ":" + ESAPI.currentRequest().getLocalPort() + " " + moduleName + " " + msg, throwable);
312315
} else { //!logAppName
313316
jlogger.log(level, ESAPI.currentRequest().getServerName() + ":" + ESAPI.currentRequest().getLocalPort() + " " +moduleName + " " + msg, throwable);

0 commit comments

Comments
 (0)