org.owasp.esapi.reference

Class Log4JLogger

java.lang.Object

org.apache.log4j.Category

org.apache.log4j.Logger

org.owasp.esapi.reference.Log4JLogger

All Implemented Interfaces:

org.apache.log4j.spi.AppenderAttachable, Logger

public class Log4JLogger
extends org.apache.log4j.Logger
implements Logger

Reference implementation of the Logger interface. This implementation extends org.apache.log4j.Logger in order to take advantage of per-class and per-package configuration options provided by Log4J.

Since:

October 15, 2010

See Also:

Log4JLogFactory, Log4JLoggerFactory

Nested Class Summary

Nested classes/interfaces inherited from interface org.owasp.esapi.Logger

Logger.EventType

Field Summary

Fields

Modifier and Type	Field and Description
private static java.lang.String	applicationName The application name using this log
private static org.apache.log4j.spi.LoggerFactory	factory The log factory to use in creating new instances.
private static boolean	logAppName Log the application name?
private static boolean	logServerIP Log the server ip?

Fields inherited from class org.apache.log4j.Category

additive, level, name, parent, repository, resourceBundle

Fields inherited from interface org.owasp.esapi.Logger

ALL, DEBUG, ERROR, EVENT_FAILURE, EVENT_SUCCESS, EVENT_UNSPECIFIED, FATAL, INFO, OFF, SECURITY_AUDIT, SECURITY_FAILURE, SECURITY_SUCCESS, TRACE, WARNING

Constructor Summary

Constructors

Constructor and Description
Log4JLogger(java.lang.String name)

Method Summary

Modifier and Type	Method and Description
void	always(Logger.EventType type, java.lang.String message) Log an event regardless of what logging level is enabled.
void	always(Logger.EventType type, java.lang.String message, java.lang.Throwable throwable) Log an event regardless of what logging level is enabled and also record the stack trace associated with the event.
void	always(java.lang.Object message) Always log the specified message as a SECURITY_AUDIT event type.
void	always(java.lang.Object message, java.lang.Throwable throwable) Always log the specified message as a SECURITY_AUDIT event type, along with its associated exception stack trace (if any).
private static org.apache.log4j.Level	convertESAPILeveltoLoggerLevel(int level) Converts the ESAPI logging level (a number) into the levels used by Java's logger.
void	debug(Logger.EventType type, java.lang.String message) Log a debug level security event if 'debug' level logging is enabled.
void	debug(Logger.EventType type, java.lang.String message, java.lang.Throwable throwable) Log a debug level security event if 'debug' level logging is enabled and also record the stack trace associated with the event.
void	debug(java.lang.Object message)
void	debug(java.lang.Object message, java.lang.Throwable throwable)
void	error(Logger.EventType type, java.lang.String message) Log an error level security event if 'error' level logging is enabled.
void	error(Logger.EventType type, java.lang.String message, java.lang.Throwable throwable) Log an error level security event if 'error' level logging is enabled and also record the stack trace associated with the event.
void	error(java.lang.Object message)
void	error(java.lang.Object message, java.lang.Throwable throwable)
void	fatal(Logger.EventType type, java.lang.String message) Log a fatal event if 'fatal' level logging is enabled.
void	fatal(Logger.EventType type, java.lang.String message, java.lang.Throwable throwable) Log a fatal level security event if 'fatal' level logging is enabled and also record the stack trace associated with the event.
void	fatal(java.lang.Object message)
void	fatal(java.lang.Object message, java.lang.Throwable throwable)
int	getESAPILevel() Retrieve the current ESAPI logging level for this logger.
static org.apache.log4j.Category	getInstance(java.lang.Class clazz) This method overrides Category.getInstance(java.lang.String) by supplying its own factory type as a parameter.
static org.apache.log4j.Category	getInstance(java.lang.String name) This method overrides Category.getInstance(java.lang.String) by supplying its own factory type as a parameter.
static org.apache.log4j.Logger	getLogger(java.lang.Class clazz) This method overrides Logger.getLogger(java.lang.String) by supplying its own factory type as a parameter.
static org.apache.log4j.Logger	getLogger(java.lang.String name) This method overrides Logger.getLogger(java.lang.String) by supplying its own factory type as a parameter.
java.lang.String	getUserInfo()
void	info(Logger.EventType type, java.lang.String message) Log an info level security event if 'info' level logging is enabled.
void	info(Logger.EventType type, java.lang.String message, java.lang.Throwable throwable) Log an info level security event if 'info' level logging is enabled and also record the stack trace associated with the event.
void	info(java.lang.Object message)
void	info(java.lang.Object message, java.lang.Throwable throwable)
boolean	isDebugEnabled() Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.
boolean	isErrorEnabled() Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.
boolean	isFatalEnabled() Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.
boolean	isInfoEnabled() Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.
boolean	isTraceEnabled() Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.
boolean	isWarningEnabled() Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.
private void	log(org.apache.log4j.Level level, Logger.EventType type, java.lang.String message, java.lang.Throwable throwable) Log the message after optionally encoding any special characters that might be dangerous when viewed by an HTML based log viewer.
void	setLevel(int level) Dynamically set the ESAPI logging severity level.
void	trace(Logger.EventType type, java.lang.String message) Log a trace level security event if 'trace' level logging is enabled.
void	trace(Logger.EventType type, java.lang.String message, java.lang.Throwable throwable) Log a trace level security event if 'trace' level logging is enabled and also record the stack trace associated with the event.
void	trace(java.lang.Object message)
void	trace(java.lang.Object message, java.lang.Throwable throwable)
void	warn(java.lang.Object message)
void	warn(java.lang.Object message, java.lang.Throwable throwable)
void	warning(Logger.EventType type, java.lang.String message) Log a warning level security event if 'warning' level logging is enabled.
void	warning(Logger.EventType type, java.lang.String message, java.lang.Throwable throwable) Log a warning level security event if 'warning' level logging is enabled and also record the stack trace associated with the event.

Methods inherited from class org.apache.log4j.Logger

getLogger, getRootLogger

Methods inherited from class org.apache.log4j.Category

addAppender, assertLog, callAppenders, exists, forcedLog, getAdditivity, getAllAppenders, getAppender, getChainedPriority, getCurrentCategories, getDefaultHierarchy, getEffectiveLevel, getHierarchy, getLevel, getLoggerRepository, getName, getParent, getPriority, getResourceBundle, getResourceBundleString, getRoot, isAttached, isEnabledFor, l7dlog, l7dlog, log, log, log, removeAllAppenders, removeAppender, removeAppender, setAdditivity, setLevel, setPriority, setResourceBundle, shutdown

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

factory

private static org.apache.log4j.spi.LoggerFactory factory

The log factory to use in creating new instances.

applicationName

private static java.lang.String applicationName

The application name using this log

logAppName

private static boolean logAppName

Log the application name?

logServerIP

private static boolean logServerIP

Log the server ip?

Constructor Detail

Log4JLogger

public Log4JLogger(java.lang.String name)

Method Detail

getInstance

public static org.apache.log4j.Category getInstance(java.lang.String name)

This method overrides Category.getInstance(java.lang.String) by supplying its own factory type as a parameter.

getInstance

public static org.apache.log4j.Category getInstance(java.lang.Class clazz)

This method overrides Category.getInstance(java.lang.String) by supplying its own factory type as a parameter.

getLogger

public static org.apache.log4j.Logger getLogger(java.lang.String name)

This method overrides Logger.getLogger(java.lang.String) by supplying its own factory type as a parameter.

getLogger

public static org.apache.log4j.Logger getLogger(java.lang.Class clazz)

This method overrides Logger.getLogger(java.lang.String) by supplying its own factory type as a parameter.

setLevel

public void setLevel(int level)

Dynamically set the ESAPI logging severity level. All events of this level and higher will be logged from this point forward for all logs. All events below this level will be discarded. Note: In this implementation, this change is not persistent, meaning that if the application is restarted, the log level will revert to the level defined in the ESAPI SecurityConfiguration properties file.

Specified by:

setLevel in interface Logger

Parameters:

level - The level to set the logging level to.

getESAPILevel

public int getESAPILevel()

Retrieve the current ESAPI logging level for this logger. See Log4JLogger for an explanation of why this method is not simply called getLevel(). Explanation: Since this class extends Log4j's Logger class which has a getLevel() method that returns extended by org.apache.log4j.Level, we can't simply have a getLevel() that simply returns an int. Hence we renamed it to getESAPILevel().

Specified by:

getESAPILevel in interface Logger

Returns:

The current logging level.

convertESAPILeveltoLoggerLevel

private static org.apache.log4j.Level convertESAPILeveltoLoggerLevel(int level)

Converts the ESAPI logging level (a number) into the levels used by Java's logger.

Parameters:

level - The ESAPI to convert.

Returns:

The Log4J logging Level that is equivalent.

Throws:

java.lang.IllegalArgumentException - if the supplied ESAPI level doesn't make a level that is currently defined.

always

public void always(Logger.EventType type,
                   java.lang.String message,
                   java.lang.Throwable throwable)

Log an event regardless of what logging level is enabled and also record the stack trace associated with the event.

Specified by:

always in interface Logger

Parameters:

type - the type of event

message - the message to log

throwable - the exception to be logged

always

public void always(Logger.EventType type,
                   java.lang.String message)

Log an event regardless of what logging level is enabled.

Specified by:

always in interface Logger

Parameters:

type - the type of event

message - the message to log

trace

public void trace(Logger.EventType type,
                  java.lang.String message,
                  java.lang.Throwable throwable)

Log a trace level security event if 'trace' level logging is enabled and also record the stack trace associated with the event.

Specified by:

trace in interface Logger

Parameters:

type - the type of event

message - the message to log

throwable - the exception to be logged

trace

public void trace(Logger.EventType type,
                  java.lang.String message)

Log a trace level security event if 'trace' level logging is enabled.

Specified by:

trace in interface Logger

Parameters:

type - the type of event

message - the message to log

debug

public void debug(Logger.EventType type,
                  java.lang.String message,
                  java.lang.Throwable throwable)

Log a debug level security event if 'debug' level logging is enabled and also record the stack trace associated with the event.

Specified by:

debug in interface Logger

Parameters:

type - the type of event

message - the message to log

throwable - the exception to be logged

debug

public void debug(Logger.EventType type,
                  java.lang.String message)

Log a debug level security event if 'debug' level logging is enabled.

Specified by:

debug in interface Logger

Parameters:

type - the type of event

message - the message to log

info

public void info(Logger.EventType type,
                 java.lang.String message)

Log an info level security event if 'info' level logging is enabled.

Specified by:

info in interface Logger

Parameters:

type - the type of event

message - the message to log

info

public void info(Logger.EventType type,
                 java.lang.String message,
                 java.lang.Throwable throwable)

Log an info level security event if 'info' level logging is enabled and also record the stack trace associated with the event.

Specified by:

info in interface Logger

Parameters:

type - the type of event

message - the message to log

throwable - the exception to be logged

warning

public void warning(Logger.EventType type,
                    java.lang.String message,
                    java.lang.Throwable throwable)

Log a warning level security event if 'warning' level logging is enabled and also record the stack trace associated with the event.

Specified by:

warning in interface Logger

Parameters:

type - the type of event

message - the message to log

throwable - the exception to be logged

warning

public void warning(Logger.EventType type,
                    java.lang.String message)

Log a warning level security event if 'warning' level logging is enabled.

Specified by:

warning in interface Logger

Parameters:

type - the type of event

message - the message to log

error

public void error(Logger.EventType type,
                  java.lang.String message,
                  java.lang.Throwable throwable)

Log an error level security event if 'error' level logging is enabled and also record the stack trace associated with the event.

Specified by:

error in interface Logger

Parameters:

type - the type of event

message - the message to log

throwable - the exception to be logged

error

public void error(Logger.EventType type,
                  java.lang.String message)

Log an error level security event if 'error' level logging is enabled.

Specified by:

error in interface Logger

Parameters:

type - the type of event

message - the message to log

fatal

public void fatal(Logger.EventType type,
                  java.lang.String message,
                  java.lang.Throwable throwable)

Log a fatal level security event if 'fatal' level logging is enabled and also record the stack trace associated with the event.

Specified by:

fatal in interface Logger

Parameters:

type - the type of event

message - the message to log

throwable - the exception to be logged

fatal

public void fatal(Logger.EventType type,
                  java.lang.String message)

Log a fatal event if 'fatal' level logging is enabled.

Specified by:

fatal in interface Logger

Parameters:

type - the type of event

message - the message to log

always

public void always(java.lang.Object message)

Always log the specified message as a SECURITY_AUDIT event type.

Parameters:

message - The String representation of the specified message as logged by calling the object's toString() method.

always

public void always(java.lang.Object message,
                   java.lang.Throwable throwable)

Always log the specified message as a SECURITY_AUDIT event type, along with its associated exception stack trace (if any).

Parameters:

message - The String representation of the specified message as logged by calling the object's toString() method.

trace

public void trace(java.lang.Object message)

Overrides:

trace in class org.apache.log4j.Logger

trace

public void trace(java.lang.Object message,
                  java.lang.Throwable throwable)

Overrides:

trace in class org.apache.log4j.Logger

debug

public void debug(java.lang.Object message)

Overrides:

debug in class org.apache.log4j.Category

debug

public void debug(java.lang.Object message,
                  java.lang.Throwable throwable)

Overrides:

debug in class org.apache.log4j.Category

info

public void info(java.lang.Object message)

Overrides:

info in class org.apache.log4j.Category

info

public void info(java.lang.Object message,
                 java.lang.Throwable throwable)

Overrides:

info in class org.apache.log4j.Category

warn

public void warn(java.lang.Object message)

Overrides:

warn in class org.apache.log4j.Category

warn

public void warn(java.lang.Object message,
                 java.lang.Throwable throwable)

Overrides:

warn in class org.apache.log4j.Category

error

public void error(java.lang.Object message)

Overrides:

error in class org.apache.log4j.Category

error

public void error(java.lang.Object message,
                  java.lang.Throwable throwable)

Overrides:

error in class org.apache.log4j.Category

fatal

public void fatal(java.lang.Object message)

Overrides:

fatal in class org.apache.log4j.Category

fatal

public void fatal(java.lang.Object message,
                  java.lang.Throwable throwable)

Overrides:

fatal in class org.apache.log4j.Category

log

private void log(org.apache.log4j.Level level,
                 Logger.EventType type,
                 java.lang.String message,
                 java.lang.Throwable throwable)

Log the message after optionally encoding any special characters that might be dangerous when viewed by an HTML based log viewer. Also encode any carriage returns and line feeds to prevent log injection attacks. This logs all the supplied parameters plus the user ID, user's source IP, a logging specific session ID, and the current date/time. It will only log the message if the current logging level is enabled, otherwise it will discard the message.

Parameters:

level - defines the set of recognized logging levels (TRACE, INFO, DEBUG, WARNING, ERROR, FATAL)

type - the type of the event (SECURITY SUCCESS, SECURITY FAILURE, EVENT SUCCESS, EVENT FAILURE)

message - the message to be logged

throwable - the Throwable from which to generate an exception stack trace.

isDebugEnabled

public boolean isDebugEnabled()

Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.

Specified by:

isDebugEnabled in interface Logger

Overrides:

isDebugEnabled in class org.apache.log4j.Category

Returns:

true if debug level messages will be output to the log

isErrorEnabled

public boolean isErrorEnabled()

Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.

Specified by:

isErrorEnabled in interface Logger

Returns:

true if error level messages will be output to the log

isFatalEnabled

public boolean isFatalEnabled()

Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.

Specified by:

isFatalEnabled in interface Logger

Returns:

true if fatal level messages will be output to the log

isInfoEnabled

public boolean isInfoEnabled()

Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.

Specified by:

isInfoEnabled in interface Logger

Overrides:

isInfoEnabled in class org.apache.log4j.Category

Returns:

true if info level messages will be output to the log

isTraceEnabled

public boolean isTraceEnabled()

Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.

Specified by:

isTraceEnabled in interface Logger

Overrides:

isTraceEnabled in class org.apache.log4j.Logger

Returns:

true if trace level messages will be output to the log

isWarningEnabled

public boolean isWarningEnabled()

Allows the caller to determine if messages logged at this level will be discarded, to avoid performing expensive processing.

Specified by:

isWarningEnabled in interface Logger

Returns:

true if warning level messages will be output to the log

getUserInfo

public java.lang.String getUserInfo()