Update the logging properties to opt-out of the prefix events #844

configuration/esapi/ESAPI.properties

@@ -407,6 +407,10 @@ Logger.UserInfo=true
 # Determines whether ESAPI should log the session id and client IP.
 Logger.ClientInfo=true
 
+# Determines whether ESAPI should log the prefix of [EVENT_TYPE - APPLICATION NAME].
+# If all above Logger entries are set to false, as well as LogPrefix, then the output would be the same as if no ESAPI was used
+Logger.LogPrefix=true
+
 #===========================================================================
 # ESAPI Intrusion Detection
 #

src/main/java/org/owasp/esapi/PropNames.java

@@ -111,6 +111,7 @@ public final class PropNames {
     public static final String LOG_ENCODING_REQUIRED                                                            = "Logger.LogEncodingRequired";
     public static final String LOG_APPLICATION_NAME                                                             = "Logger.LogApplicationName";
     public static final String LOG_SERVER_IP                                                                    = "Logger.LogServerIP";
+    public static final String LOG_PREFIX                                                                       = "Logger.LogPrefix";
 
     public static final String VALIDATION_PROPERTIES                                                            = "Validator.ConfigurationFile";
     public static final String VALIDATION_PROPERTIES_MULTIVALUED                                                = "Validator.ConfigurationFile.MultiValued";

src/main/java/org/owasp/esapi/logging/appender/EventTypeLogSupplier.java

@@ -30,18 +30,24 @@ public class EventTypeLogSupplier // implements Supplier<String>
 {
     /** EventType reference to supply log representation of. */
     private final EventType eventType;
+    /** Whether to log or not the event type */
+    private boolean logEventType = true;
 
     /**
      * Ctr
      *
-     * @param evtyp EventType reference to supply log representation for
+     * @param eventType EventType reference to supply log representation for
      */
-    public EventTypeLogSupplier(EventType evtyp) {
-        this.eventType = evtyp == null ? Logger.EVENT_UNSPECIFIED : evtyp;
+    public EventTypeLogSupplier(EventType eventType) {
+        this.eventType = eventType == null ? Logger.EVENT_UNSPECIFIED : eventType;
     }
 
     // @Override    -- Uncomment when we switch to Java 8 as minimal baseline.
     public String get() {
-        return eventType.toString();
+        return logEventType ? eventType.toString() : "";
+    }
+
+    public void setLogEventType(boolean logEventType) {
+        this.logEventType = logEventType;
     }
 }

src/main/java/org/owasp/esapi/logging/appender/LogPrefixAppender.java

@@ -35,27 +35,47 @@ public class LogPrefixAppender implements LogAppender {
     private final boolean logApplicationName;
     /** Application Name to record. */
     private final String appName;
+    /** Whether or not to print the prefix. */
+    private final boolean logPrefix;
 
     /**
-     * Ctr.
+     * Constructor
      *
      * @param logUserInfo      Whether or not to record user information
      * @param logClientInfo      Whether or not to record client information
      * @param logServerIp        Whether or not to record server ip information
      * @param logApplicationName Whether or not to record application name
      * @param appName            Application Name to record.
+     * @param logPrefix          is set by default to true
      */
+    @SuppressWarnings("JavadocReference")
     public LogPrefixAppender(boolean logUserInfo, boolean logClientInfo, boolean logServerIp, boolean logApplicationName, String appName) {
+        this(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName, true);
+    }
+
+    /**
+     * Constructor
+     *
+     * @param logUserInfo        Whether or not to record user information
+     * @param logClientInfo      Whether or not to record client information
+     * @param logServerIp        Whether or not to record server ip information
+     * @param logApplicationName Whether or not to record application name
+     * @param appName            Application Name to record.
+     * @param logPrefix          Whether or not to print the prefix
+     */
+    public LogPrefixAppender(boolean logUserInfo, boolean logClientInfo, boolean logServerIp, boolean logApplicationName, String appName, boolean logPrefix) {
         this.logUserInfo = logUserInfo;
         this.logClientInfo = logClientInfo;
         this.logServerIp = logServerIp;
         this.logApplicationName = logApplicationName;
         this.appName = appName;
+        this.logPrefix = logPrefix;
     }
 
     @Override
     public String appendTo(String logName, EventType eventType, String message) {
         EventTypeLogSupplier eventTypeSupplier = new EventTypeLogSupplier(eventType);
+        eventTypeSupplier.setLogEventType(this.logPrefix);
 
         UserInfoSupplier userInfoSupplier = new UserInfoSupplier();
         userInfoSupplier.setLogUserInfo(logUserInfo);
@@ -66,6 +86,7 @@ public String appendTo(String logName, EventType eventType, String message) {
         ServerInfoSupplier serverInfoSupplier = new ServerInfoSupplier(logName);
         serverInfoSupplier.setLogServerIp(logServerIp);
         serverInfoSupplier.setLogApplicationName(logApplicationName, appName);
+        serverInfoSupplier.setLogLogName(logPrefix);
 
         String eventTypeMsg = eventTypeSupplier.get().trim();
         String userInfoMsg = userInfoSupplier.get().trim();
@@ -80,17 +101,20 @@ public String appendTo(String logName, EventType eventType, String message) {
 
         String[] optionalPrefixContent = new String[] {userInfoMsg + clientInfoMsg, serverInfoMsg};
 
-        StringBuilder logPrefix = new StringBuilder();
-        //EventType is always appended
-        logPrefix.append(eventTypeMsg);
+        StringBuilder logPrefixBuilder = new StringBuilder();
+        //EventType is always appended (unless we specifically asked not to Log Prefix)
+        if (this.logPrefix) {
+            logPrefixBuilder.append(eventTypeMsg);
+        }
 
         for (String element : optionalPrefixContent) {
             if (!element.isEmpty()) {
-                logPrefix.append(" ");
-                logPrefix.append(element);
+                logPrefixBuilder.append(" ");
+                logPrefixBuilder.append(element);
             }
         }
 
-        return String.format(RESULT_FORMAT, logPrefix.toString(), message);
+        String logPrefixContent = logPrefixBuilder.toString();
+        return logPrefixContent.trim().isEmpty() ? message : String.format(RESULT_FORMAT, logPrefixContent, message);
     }
 }

src/main/java/org/owasp/esapi/logging/appender/ServerInfoSupplier.java

@@ -34,7 +34,8 @@ public class ServerInfoSupplier     // implements Supplier<String>
     private boolean logAppName = true;
     /** The application name to log. */
     private String applicationName = "";
-
+    /** Whether to log the Name */
+    private boolean logLogName = true;
     /** Reference to the associated logname/module name. */
     private final String logName;
 
@@ -57,10 +58,14 @@ public String get() {
                 appInfo.append(request.getLocalAddr()).append(":").append(request.getLocalPort());
             }
         }
-        if (logAppName) {
-            appInfo.append("/").append(applicationName);
+
+        if (this.logAppName) {
+            appInfo.append("/").append(this.applicationName);
+        }
+
+        if (this.logLogName) {
+            appInfo.append("/").append(logName);
         }
-        appInfo.append("/").append(logName);
 
         return appInfo.toString();
     }
@@ -74,6 +79,15 @@ public void setLogServerIp(boolean log) {
         this.logServerIP = log;
     }
 
+    /**
+     * Specify whether the instance should record the prefix.
+     *
+     * @param logLogName {@code true} to record
+     */
+    public void setLogLogName(boolean logLogName) {
+        this.logLogName = logLogName;
+    }
+
     /**
      * Specify whether the instance should record the application name
      *

src/main/java/org/owasp/esapi/logging/java/JavaLogFactory.java

@@ -20,6 +20,7 @@
 import static org.owasp.esapi.PropNames.LOG_ENCODING_REQUIRED;
 import static org.owasp.esapi.PropNames.LOG_SERVER_IP;
 import static org.owasp.esapi.PropNames.LOG_USER_INFO;
+import static org.owasp.esapi.PropNames.LOG_PREFIX;
 
 import java.io.IOException;
 import java.io.InputStream;
@@ -79,7 +80,17 @@ public class JavaLogFactory implements LogFactory {
         boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(LOG_APPLICATION_NAME);
         String appName = ESAPI.securityConfiguration().getStringProp(APPLICATION_NAME);
         boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(LOG_SERVER_IP);
-        JAVA_LOG_APPENDER = createLogAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName);
+
+        boolean logPrefix = true;
+        try {
+            logPrefix = ESAPI.securityConfiguration().getBooleanProp(LOG_PREFIX);
+        } catch (ConfigurationException ex) {
+            System.out.println("ESAPI: Failed to read Log Prefix configuration " + LOG_PREFIX + ". Defaulting to enabled" +
+                    ". Caught " + ex.getClass().getName() +
+                    "; exception message was: " + ex);
+        }
+
+        JAVA_LOG_APPENDER = createLogAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName, logPrefix);
 
         Map<Integer, JavaLogLevelHandler> levelLookup = new HashMap<>();
         levelLookup.put(Logger.ALL, JavaLogLevelHandlers.ALWAYS);
@@ -144,6 +155,20 @@ public class JavaLogFactory implements LogFactory {
         return new LogPrefixAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName);
     }
 
+    /**
+     * Populates the default log appender for use in factory-created loggers.
+     * @param appName
+     * @param logApplicationName
+     * @param logServerIp
+     * @param logClientInfo
+     * @param logPrefix
+     *
+     * @return LogAppender instance.
+     */
+    /*package*/ static LogAppender createLogAppender(boolean logUserInfo, boolean logClientInfo, boolean logServerIp, boolean logApplicationName, String appName, boolean logPrefix) {
+        return new LogPrefixAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName, logPrefix);
+    }
+
 
     @Override
     public Logger getLogger(String moduleName) {

src/main/java/org/owasp/esapi/logging/slf4j/Slf4JLogFactory.java

@@ -23,6 +23,7 @@
 import org.owasp.esapi.LogFactory;
 import org.owasp.esapi.Logger;
 import org.owasp.esapi.codecs.HTMLEntityCodec;
+import org.owasp.esapi.errors.ConfigurationException;
 import org.owasp.esapi.logging.appender.LogAppender;
 import org.owasp.esapi.logging.appender.LogPrefixAppender;
 import org.owasp.esapi.logging.cleaning.CodecLogScrubber;
@@ -36,6 +37,7 @@
 import static org.owasp.esapi.PropNames.LOG_APPLICATION_NAME;
 import static org.owasp.esapi.PropNames.APPLICATION_NAME;
 import static org.owasp.esapi.PropNames.LOG_SERVER_IP;
+import static org.owasp.esapi.PropNames.LOG_PREFIX;
 import org.slf4j.LoggerFactory;
 /**
  * LogFactory implementation which creates SLF4J supporting Loggers.
@@ -69,7 +71,17 @@ public class Slf4JLogFactory implements LogFactory {
         boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(LOG_APPLICATION_NAME);
         String appName = ESAPI.securityConfiguration().getStringProp(APPLICATION_NAME);
         boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(LOG_SERVER_IP);
-        SLF4J_LOG_APPENDER = createLogAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName);
+
+        boolean logPrefix = true;
+        try {
+            logPrefix = ESAPI.securityConfiguration().getBooleanProp(LOG_PREFIX);
+        } catch (ConfigurationException ex) {
+            System.out.println("ESAPI: Failed to read Log Prefix configuration " + LOG_PREFIX + ". Defaulting to enabled" +
+                    ". Caught " + ex.getClass().getName() +
+                    "; exception message was: " + ex);
+        }
+
+        SLF4J_LOG_APPENDER = createLogAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName, logPrefix);
 
         Map<Integer, Slf4JLogLevelHandler> levelLookup = new HashMap<>();
         levelLookup.put(Logger.ALL, Slf4JLogLevelHandlers.TRACE);
@@ -114,6 +126,19 @@ public class Slf4JLogFactory implements LogFactory {
         return new LogPrefixAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName);
     }
 
+    /**
+     * Populates the default log appender for use in factory-created loggers.
+     * @param appName
+     * @param logApplicationName
+     * @param logServerIp
+     * @param logClientInfo
+     * @param logPrefix
+     *
+     * @return LogAppender instance.
+     */
+    /*package*/ static LogAppender createLogAppender(boolean logUserInfo, boolean logClientInfo, boolean logServerIp, boolean logApplicationName, String appName, boolean logPrefix) {
+        return new LogPrefixAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName, logPrefix);
+    }
 
     @Override
     public Logger getLogger(String moduleName) {

src/main/java/org/owasp/esapi/reference/DefaultSecurityConfiguration.java

@@ -1441,14 +1441,14 @@ public Boolean getBooleanProp(String propertyName) throws ConfigurationException
         try {
             return esapiPropertyManager.getBooleanProp(propertyName);
         } catch (ConfigurationException ex) {
-            String property = properties.getProperty( propertyName );
+            String property = properties.getProperty(propertyName);
             if ( property == null ) {
                 throw new ConfigurationException( "SecurityConfiguration for " + propertyName + " not found in ESAPI.properties");
             }
-            if ( property.equalsIgnoreCase("true") || property.equalsIgnoreCase("yes" ) ) {
+            if ( property.equalsIgnoreCase("true") || property.equalsIgnoreCase("yes") ) {
                 return true;
             }
-            if ( property.equalsIgnoreCase("false") || property.equalsIgnoreCase( "no" ) ) {
+            if ( property.equalsIgnoreCase("false") || property.equalsIgnoreCase("no") ) {
                 return false;
             }
             throw new ConfigurationException( "SecurityConfiguration for " + propertyName + " has incorrect " +

src/test/java/org/owasp/esapi/logging/appender/EventTypeLogSupplierIgnoreEventTypeTest.java

@@ -0,0 +1,45 @@
+package org.owasp.esapi.logging.appender;
+
+import static org.junit.Assert.assertEquals;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
+import org.owasp.esapi.Logger;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+
+@RunWith(Parameterized.class)
+public class EventTypeLogSupplierIgnoreEventTypeTest {
+
+    @Parameterized.Parameters (name="{0} -> {1}")
+    public static Collection<Object[]> assembleTests() {
+        List<Object[]> paramSets = new ArrayList<>();
+        paramSets.add(new Object[] {Logger.EVENT_FAILURE,""});
+        paramSets.add(new Object[] {Logger.EVENT_SUCCESS,""});
+        paramSets.add(new Object[] {Logger.EVENT_UNSPECIFIED,""});
+        paramSets.add(new Object[] {Logger.SECURITY_AUDIT,""});
+        paramSets.add(new Object[] {Logger.SECURITY_FAILURE,""});
+        paramSets.add(new Object[] {Logger.SECURITY_SUCCESS,""});
+        paramSets.add(new Object[] {null, ""});
+
+        return paramSets;
+    }
+
+    private final Logger.EventType eventType;
+    private final String expectedResult;
+
+    public EventTypeLogSupplierIgnoreEventTypeTest(Logger.EventType eventType, String result) {
+        this.eventType = eventType;
+        this.expectedResult = result;
+    }
+
+    @Test
+    public void testEventTypeLogIgnoreEventType() {
+        EventTypeLogSupplier supplier = new EventTypeLogSupplier(eventType);
+        supplier.setLogEventType(false);
+        assertEquals(expectedResult, supplier.get());
+    }
+}