org.owasp.esapi.reference

Class JavaLogFactory.JavaLogger

java.lang.Object

org.owasp.esapi.reference.JavaLogFactory.JavaLogger

All Implemented Interfaces:

Logger

Enclosing class:

JavaLogFactory

private static class JavaLogFactory.JavaLogger
extends java.lang.Object
implements Logger

Reference implementation of the Logger interface. It implements most of the recommendations defined in the Logger interface description. It does not filter out any sensitive data specific to the current application or organization, such as credit cards, social security numbers, etc.

Since:

June 1, 2007

See Also:

LogFactory

Nested Class Summary

Nested classes/interfaces inherited from interface org.owasp.esapi.Logger

Logger.EventType

Field Summary

Fields

Modifier and Type	Field and Description
private java.lang.String	applicationName The application name defined in ESAPI.properties
private java.util.logging.Logger	jlogger The jlogger object used by this class to log everything.
private static boolean	logAppName Log the application name?
private static boolean	logServerIP Log the server ip?
private java.lang.String	moduleName The module name using this log.

Fields inherited from interface org.owasp.esapi.Logger

ALL, DEBUG, ERROR, EVENT_FAILURE, EVENT_SUCCESS, EVENT_UNSPECIFIED, FATAL, INFO, OFF, SECURITY_AUDIT, SECURITY_FAILURE, SECURITY_SUCCESS, TRACE, WARNING

Constructor Summary

Constructors

Modifier	Constructor and Description
private	JavaLogger(java.lang.String moduleName) Public constructor should only ever be called via the appropriate LogFactory

Method Summary

Modifier and Type	Method and Description
void	always(Logger.EventType type, java.lang.String message) Log an event regardless of what logging level is enabled.
void	always(Logger.EventType type, java.lang.String message, java.lang.Throwable throwable) Log an event regardless of what logging level is enabled and also record the stack trace associated with the event.
private static java.util.logging.Level	convertESAPILeveltoLoggerLevel(int level) Converts the ESAPI logging level (a number) into the levels used by Java's logger.
void	debug(Logger.EventType type, java.lang.String message) Log a debug level security event if 'debug' level logging is enabled.
void	debug(Logger.EventType type, java.lang.String message, java.lang.Throwable throwable) Log a debug level security event if 'debug' level logging is enabled and also record the stack trace associated with the event.
void	error(Logger.EventType type, java.lang.String message) Log an error level security event if 'error' level logging is enabled.
void	error(Logger.EventType type, java.lang.String message, java.lang.Throwable throwable) Log an error level security event if 'error' level logging is enabled and also record the stack trace associated with the event.
void	fatal(Logger.EventType type, java.lang.String message) Log a fatal event if 'fatal' level logging is enabled.
void	fatal(Logger.EventType type, java.lang.String message, java.lang.Throwable throwable) Log a fatal level security event if 'fatal' level logging is enabled and also record the stack trace associated with the event.
int	getESAPILevel() Retrieve the current ESAPI logging level for this logger.
java.lang.String	getUserInfo()
void	info(Logger.EventType type, java.lang.String message) Log an info level security event if 'info' level logging is enabled.
void	info(Logger.EventType type, java.lang.String message, java.lang.Throwable throwable) Log an info level security event if 'info' level logging is enabled and also record the stack trace associated with the event.
boolean	isDebugEnabled() Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.
boolean	isErrorEnabled() Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.
boolean	isFatalEnabled() Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.
boolean	isInfoEnabled() Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.
boolean	isTraceEnabled() Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.
boolean	isWarningEnabled() Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.
private void	log(java.util.logging.Level level, Logger.EventType type, java.lang.String message, java.lang.Throwable throwable) Log the message after optionally encoding any special characters that might be dangerous when viewed by an HTML based log viewer.
void	setLevel(int level) Dynamically set the ESAPI logging severity level.
void	trace(Logger.EventType type, java.lang.String message) Log a trace level security event if 'trace' level logging is enabled.
void	trace(Logger.EventType type, java.lang.String message, java.lang.Throwable throwable) Log a trace level security event if 'trace' level logging is enabled and also record the stack trace associated with the event.
void	warning(Logger.EventType type, java.lang.String message) Log a warning level security event if 'warning' level logging is enabled.
void	warning(Logger.EventType type, java.lang.String message, java.lang.Throwable throwable) Log a warning level security event if 'warning' level logging is enabled and also record the stack trace associated with the event.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

jlogger

private java.util.logging.Logger jlogger

The jlogger object used by this class to log everything.

moduleName

private java.lang.String moduleName

The module name using this log.

applicationName

private java.lang.String applicationName

The application name defined in ESAPI.properties

logAppName

private static boolean logAppName

Log the application name?

logServerIP

private static boolean logServerIP

Log the server ip?

Constructor Detail

JavaLogger

private JavaLogger(java.lang.String moduleName)

Public constructor should only ever be called via the appropriate LogFactory

Parameters:

moduleName - the module name

Method Detail

setLevel

public void setLevel(int level)

Dynamically set the ESAPI logging severity level. All events of this level and higher will be logged from this point forward for all logs. All events below this level will be discarded. Note: In this implementation, this change is not persistent, meaning that if the application is restarted, the log level will revert to the level defined in the ESAPI SecurityConfiguration properties file.

Specified by:

setLevel in interface Logger

Parameters:

level - The level to set the logging level to.

getESAPILevel

public int getESAPILevel()

Retrieve the current ESAPI logging level for this logger. See Log4JLogger for an explanation of why this method is not simply called getLevel().

Specified by:

getESAPILevel in interface Logger

Returns:

The current logging level.

See Also:

Log4JLogger.getESAPILevel()

convertESAPILeveltoLoggerLevel

private static java.util.logging.Level convertESAPILeveltoLoggerLevel(int level)

Converts the ESAPI logging level (a number) into the levels used by Java's logger.

Parameters:

level - The ESAPI to convert.

Returns:

The Java logging Level that is equivalent.

Throws:

java.lang.IllegalArgumentException - if the supplied ESAPI level doesn't make a level that is currently defined.

trace

public void trace(Logger.EventType type,
                  java.lang.String message,
                  java.lang.Throwable throwable)

Log a trace level security event if 'trace' level logging is enabled and also record the stack trace associated with the event.

Specified by:

trace in interface Logger

Parameters:

type - the type of event

message - the message to log

throwable - the exception to be logged

trace

public void trace(Logger.EventType type,
                  java.lang.String message)

Log a trace level security event if 'trace' level logging is enabled.

Specified by:

trace in interface Logger

Parameters:

type - the type of event

message - the message to log

debug

public void debug(Logger.EventType type,
                  java.lang.String message,
                  java.lang.Throwable throwable)

Log a debug level security event if 'debug' level logging is enabled and also record the stack trace associated with the event.

Specified by:

debug in interface Logger

Parameters:

type - the type of event

message - the message to log

throwable - the exception to be logged

debug

public void debug(Logger.EventType type,
                  java.lang.String message)

Log a debug level security event if 'debug' level logging is enabled.

Specified by:

debug in interface Logger

Parameters:

type - the type of event

message - the message to log

info

public void info(Logger.EventType type,
                 java.lang.String message)

Log an info level security event if 'info' level logging is enabled.

Specified by:

info in interface Logger

Parameters:

type - the type of event

message - the message to log

info

public void info(Logger.EventType type,
                 java.lang.String message,
                 java.lang.Throwable throwable)

Log an info level security event if 'info' level logging is enabled and also record the stack trace associated with the event.

Specified by:

info in interface Logger

Parameters:

type - the type of event

message - the message to log

throwable - the exception to be logged

warning

public void warning(Logger.EventType type,
                    java.lang.String message,
                    java.lang.Throwable throwable)

Log a warning level security event if 'warning' level logging is enabled and also record the stack trace associated with the event.

Specified by:

warning in interface Logger

Parameters:

type - the type of event

message - the message to log

throwable - the exception to be logged

warning

public void warning(Logger.EventType type,
                    java.lang.String message)

Log a warning level security event if 'warning' level logging is enabled.

Specified by:

warning in interface Logger

Parameters:

type - the type of event

message - the message to log

error

public void error(Logger.EventType type,
                  java.lang.String message,
                  java.lang.Throwable throwable)

Log an error level security event if 'error' level logging is enabled and also record the stack trace associated with the event.

Specified by:

error in interface Logger

Parameters:

type - the type of event

message - the message to log

throwable - the exception to be logged

error

public void error(Logger.EventType type,
                  java.lang.String message)

Log an error level security event if 'error' level logging is enabled.

Specified by:

error in interface Logger

Parameters:

type - the type of event

message - the message to log

fatal

public void fatal(Logger.EventType type,
                  java.lang.String message,
                  java.lang.Throwable throwable)

Log a fatal level security event if 'fatal' level logging is enabled and also record the stack trace associated with the event.

Specified by:

fatal in interface Logger

Parameters:

type - the type of event

message - the message to log

throwable - the exception to be logged

fatal

public void fatal(Logger.EventType type,
                  java.lang.String message)

Log a fatal event if 'fatal' level logging is enabled.

Specified by:

fatal in interface Logger

Parameters:

type - the type of event

message - the message to log

log

private void log(java.util.logging.Level level,
                 Logger.EventType type,
                 java.lang.String message,
                 java.lang.Throwable throwable)

Log the message after optionally encoding any special characters that might be dangerous when viewed by an HTML based log viewer. Also encode any carriage returns and line feeds to prevent log injection attacks. This logs all the supplied parameters plus the user ID, user's source IP, a logging specific session ID, and the current date/time. It will only log the message if the current logging level is enabled, otherwise it will discard the message.

Parameters:

level - defines the set of recognized logging levels (TRACE, INFO, DEBUG, WARNING, ERROR, FATAL)

type - the type of the event (SECURITY SUCCESS, SECURITY FAILURE, EVENT SUCCESS, EVENT FAILURE)

message - the message

throwable - the throwable

isDebugEnabled

public boolean isDebugEnabled()

Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.

Specified by:

isDebugEnabled in interface Logger

Returns:

true if debug level messages will be output to the log

isErrorEnabled

public boolean isErrorEnabled()

Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.

Specified by:

isErrorEnabled in interface Logger

Returns:

true if error level messages will be output to the log

isFatalEnabled

public boolean isFatalEnabled()

Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.

Specified by:

isFatalEnabled in interface Logger

Returns:

true if fatal level messages will be output to the log

isInfoEnabled

public boolean isInfoEnabled()

Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.

Specified by:

isInfoEnabled in interface Logger

Returns:

true if info level messages will be output to the log

isTraceEnabled

public boolean isTraceEnabled()

Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.

Specified by:

isTraceEnabled in interface Logger

Returns:

true if trace level messages will be output to the log

isWarningEnabled

public boolean isWarningEnabled()

Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.

Specified by:

isWarningEnabled in interface Logger

Returns:

true if warning level messages will be output to the log

getUserInfo

public java.lang.String getUserInfo()

always

public void always(Logger.EventType type,
                   java.lang.String message)

Log an event regardless of what logging level is enabled.

Specified by:

always in interface Logger

Parameters:

type - the type of event

message - the message to log

always

public void always(Logger.EventType type,
                   java.lang.String message,
                   java.lang.Throwable throwable)

Log an event regardless of what logging level is enabled and also record the stack trace associated with the event.

Specified by:

always in interface Logger

Parameters:

type - the type of event

message - the message to log

throwable - the exception to be logged