{"action":"created","comment":{"url":"https://api.github.com/repos/SonarSource/sonar-java/pulls/comments/227670174","pull_request_review_id":167762948,"id":227670174,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIyNzY3MDE3NA==","diff_hunk":"@@ -0,0 +1,142 @@\n+<p>Configuring loggers is security-sensitive. It has led in the past to the following vulnerabilities:</p>\n+<ul>\n+  <li> <a href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0285\">CVE-2018-0285</a> </li>\n+  <li> <a href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1127\">CVE-2000-1127</a> </li>\n+  <li> <a href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15113\">CVE-2017-15113</a> </li>\n+  <li> <a href=\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5742\">CVE-2015-5742</a> </li>\n+</ul>\n+<p>Logs are useful before, during and after a security incident.</p>\n+<ul>\n+  <li> Attackers will most of the time start their nefarious work by probing the system for vulnerabilities. Monitoring this activity and stopping it\n+  is the first step to prevent an attack from ever happening. </li>\n+  <li> In case of a successful attack, logs should contain enough information to understand what damage an attacker may have inflicted. </li>\n+</ul>\n+<p>Logs are also a target for attackers because they might contain sensitive information. Configuring loggers has an impact on the type of information\n+logged and how they are logged.</p>\n+<p>This rule flags for review code that initiates loggers configuration. The goal is to guide security code reviews.</p>\n+<h2>Ask Yourself Whether</h2>\n+<ul>\n+  <li> unauthorized users might have access to the logs, either because they are stored in an insecure location or because the application gives\n+  access to them. </li>\n+  <li> the logs contain sensitive information on a production server. This can happen when the logger is in debug mode. </li>\n+  <li> the log can grow without limit. This can happen when additional information is written into logs every time a user performs an action and the\n+  user can perform the action as many times as he/she wants. </li>\n+  <li> the logs do not contain enough information to understand the damage an attacker might have inflicted. The loggers mode (info, warn, error)\n+  might filter out important information. They might not print contextual information like the precise time of events or the server hostname. </li>\n+  <li> the logs are only stored locally instead of being backuped or replicated. </li>\n+</ul>\n+<p>You are at risk if you answered yes to any of those questions.</p>\n+<h2>Recommended Secure Coding Practices</h2>\n+<ul>\n+  <li> Check that your production deployment doesn't have its loggers in \"debug\" mode as it might write sensitive information in logs. </li>\n+  <li> Production logs should be stored in a secure location which is only accessible to system administrators. </li>\n+  <li> Configure the loggers to display all warnings, info and error messages. Write relevant information such as the precise time of events and the\n+  hostname. </li>\n+  <li> Choose log format which is easy to parse and process automatically. It is important to process logs rapidly in case of an attack so that the\n+  impact is known and limited. </li>\n+  <li> Check that the permissions of the log files are correct. If you index the logs in some other service, make sure that the transfer and the\n+  service are secure too. </li>\n+  <li> Add limits to the size of the logs and make sure that no user can fill the disk with logs. This can happen even when the user does not control\n+  the logged information. An attacker could just repeat a logged action many times. </li>\n+</ul>\n+<p>Remember that configuring loggers properly doesn't make them bullet-proof. Here is a list of recommendations explaining on how to use your\n+logs:</p>\n+<ul>\n+  <li> Don't log any sensitive information. This obviously includes passwords and credit card numbers but also any personal information such as user\n+  names, locations, etc... Usually any information which is protected by law is good candidate for removal. </li>\n+  <li> Sanitize all user inputs before writing them in the logs. This includes checking its size, content, encoding, syntax, etc... As for any user\n+  input, validate using whitelists whenever possible. Enabling users to write what they want in your logs can have many impacts. It could for example\n+  use all your storage space or compromise your log indexing service. </li>\n+  <li> Log enough information to monitor suspicious activities and evaluate the impact an attacker might have on your systems. Register events such as\n+  failed logins, successful logins, server side input validation failures, access denials and any important transaction. </li>\n+  <li> Monitor the logs for any suspicious activity. </li>\n+</ul>\n+<p>See</p>\n+<ul>\n+  <li> <a href=\"https://cwe.mitre.org/data/definitions/532.html\">MITRE, CWE-532</a> - Information Exposure Through Log Files </li>\n+  <li> <a href=\"https://cwe.mitre.org/data/definitions/117.html\">MITRE, CWE-117</a> - Improper Output Neutralization for Logs </li>\n+  <li> <a href=\"https://cwe.mitre.org/data/definitions/778.html\">MITRE, CWE-778</a> - Insufficient Logging </li>\n+  <li> [OWASP Top 10 2017 Category A3 - Sensitive Data Exposure </li>\n+  <li> [OWASP Top 10 2017 Category A10 - Insufficient Logging &amp; Monitoring </li>\n+  <li> <a href=\"https://www.sans.org/top25-software-errors/#cat3\">SANS Top 25</a> - Porous Defenses </li>\n+</ul>\n+<h2>Questionable Code Example</h2>\n+<p>This rule supports the following libraries: Log4J, <code>java.util.logging</code> and Logback</p>\n+<pre>\n+// === Log4J 2 ===\n+import org.apache.logging.log4j.core.config.builder.api.ConfigurationBuilderFactory;\n+import org.apache.logging.log4j.Level;\n+import org.apache.logging.log4j.core.*;\n+import org.apache.logging.log4j.core.config.*;\n+\n+abstract class CustomConfigFactory extends ConfigurationFactory {\n+    // ...","path":"java-checks/src/main/resources/org/sonar/l10n/java/rules/squid/S4792_java.html","position":73,"original_position":73,"commit_id":"53edea09a302657a49e92eaf78778d9062a41866","original_commit_id":"53edea09a302657a49e92eaf78778d9062a41866","user":{"login":"christophe-zurn-sonarsource","id":36889251,"node_id":"MDQ6VXNlcjM2ODg5MjUx","avatar_url":"https://avatars2.githubusercontent.com/u/36889251?v=4","gravatar_id":"","url":"https://api.github.com/users/christophe-zurn-sonarsource","html_url":"https://github.com/christophe-zurn-sonarsource","followers_url":"https://api.github.com/users/christophe-zurn-sonarsource/followers","following_url":"https://api.github.com/users/christophe-zurn-sonarsource/following{/other_user}","gists_url":"https://api.github.com/users/christophe-zurn-sonarsource/gists{/gist_id}","starred_url":"https://api.github.com/users/christophe-zurn-sonarsource/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/christophe-zurn-sonarsource/subscriptions","organizations_url":"https://api.github.com/users/christophe-zurn-sonarsource/orgs","repos_url":"https://api.github.com/users/christophe-zurn-sonarsource/repos","events_url":"https://api.github.com/users/christophe-zurn-sonarsource/events{/privacy}","received_events_url":"https://api.github.com/users/christophe-zurn-sonarsource/received_events","type":"User","site_admin":false},"body":"RSPEC should describe this part of the code as `Questionable`, and why it is so","created_at":"2018-10-24T07:29:37Z","updated_at":"2018-10-24T07:58:45Z","html_url":"https://github.com/SonarSource/sonar-java/pull/2266#discussion_r227670174","pull_request_url":"https://api.github.com/repos/SonarSource/sonar-java/pulls/2266","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/SonarSource/sonar-java/pulls/comments/227670174"},"html":{"href":"https://github.com/SonarSource/sonar-java/pull/2266#discussion_r227670174"},"pull_request":{"href":"https://api.github.com/repos/SonarSource/sonar-java/pulls/2266"}}},"pull_request":{"url":"https://api.github.com/repos/SonarSource/sonar-java/pulls/2266","id":225020516,"node_id":"MDExOlB1bGxSZXF1ZXN0MjI1MDIwNTE2","html_url":"https://github.com/SonarSource/sonar-java/pull/2266","diff_url":"https://github.com/SonarSource/sonar-java/pull/2266.diff","patch_url":"https://github.com/SonarSource/sonar-java/pull/2266.patch","issue_url":"https://api.github.com/repos/SonarSource/sonar-java/issues/2266","number":2266,"state":"open","locked":false,"title":"SONARJAVA-2899 Loggers configuration is a security hotspot","user":{"login":"benzonico","id":1199708,"node_id":"MDQ6VXNlcjExOTk3MDg=","avatar_url":"https://avatars2.githubusercontent.com/u/1199708?v=4","gravatar_id":"","url":"https://api.github.com/users/benzonico","html_url":"https://github.com/benzonico","followers_url":"https://api.github.com/users/benzonico/followers","following_url":"https://api.github.com/users/benzonico/following{/other_user}","gists_url":"https://api.github.com/users/benzonico/gists{/gist_id}","starred_url":"https://api.github.com/users/benzonico/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benzonico/subscriptions","organizations_url":"https://api.github.com/users/benzonico/orgs","repos_url":"https://api.github.com/users/benzonico/repos","events_url":"https://api.github.com/users/benzonico/events{/privacy}","received_events_url":"https://api.github.com/users/benzonico/received_events","type":"User","site_admin":false},"body":"","created_at":"2018-10-23T12:35:38Z","updated_at":"2018-10-24T07:58:45Z","closed_at":null,"merged_at":null,"merge_commit_sha":"27ee41b47a1c615ce74d1d78c5770538248f6bac","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/SonarSource/sonar-java/pulls/2266/commits","review_comments_url":"https://api.github.com/repos/SonarSource/sonar-java/pulls/2266/comments","review_comment_url":"https://api.github.com/repos/SonarSource/sonar-java/pulls/comments{/number}","comments_url":"https://api.github.com/repos/SonarSource/sonar-java/issues/2266/comments","statuses_url":"https://api.github.com/repos/SonarSource/sonar-java/statuses/53edea09a302657a49e92eaf78778d9062a41866","head":{"label":"SonarSource:SONARJAVA-2899","ref":"SONARJAVA-2899","sha":"53edea09a302657a49e92eaf78778d9062a41866","user":{"login":"SonarSource","id":545988,"node_id":"MDEyOk9yZ2FuaXphdGlvbjU0NTk4OA==","avatar_url":"https://avatars0.githubusercontent.com/u/545988?v=4","gravatar_id":"","url":"https://api.github.com/users/SonarSource","html_url":"https://github.com/SonarSource","followers_url":"https://api.github.com/users/SonarSource/followers","following_url":"https://api.github.com/users/SonarSource/following{/other_user}","gists_url":"https://api.github.com/users/SonarSource/gists{/gist_id}","starred_url":"https://api.github.com/users/SonarSource/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SonarSource/subscriptions","organizations_url":"https://api.github.com/users/SonarSource/orgs","repos_url":"https://api.github.com/users/SonarSource/repos","events_url":"https://api.github.com/users/SonarSource/events{/privacy}","received_events_url":"https://api.github.com/users/SonarSource/received_events","type":"Organization","site_admin":false},"repo":{"id":5674787,"node_id":"MDEwOlJlcG9zaXRvcnk1Njc0Nzg3","name":"sonar-java","full_name":"SonarSource/sonar-java","private":false,"owner":{"login":"SonarSource","id":545988,"node_id":"MDEyOk9yZ2FuaXphdGlvbjU0NTk4OA==","avatar_url":"https://avatars0.githubusercontent.com/u/545988?v=4","gravatar_id":"","url":"https://api.github.com/users/SonarSource","html_url":"https://github.com/SonarSource","followers_url":"https://api.github.com/users/SonarSource/followers","following_url":"https://api.github.com/users/SonarSource/following{/other_user}","gists_url":"https://api.github.com/users/SonarSource/gists{/gist_id}","starred_url":"https://api.github.com/users/SonarSource/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SonarSource/subscriptions","organizations_url":"https://api.github.com/users/SonarSource/orgs","repos_url":"https://api.github.com/users/SonarSource/repos","events_url":"https://api.github.com/users/SonarSource/events{/privacy}","received_events_url":"https://api.github.com/users/SonarSource/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/SonarSource/sonar-java","description":":coffee: SonarJava : Java static analyzer for SonarQube & SonarLint","fork":false,"url":"https://api.github.com/repos/SonarSource/sonar-java","forks_url":"https://api.github.com/repos/SonarSource/sonar-java/forks","keys_url":"https://api.github.com/repos/SonarSource/sonar-java/keys{/key_id}","collaborators_url":"https://api.github.com/repos/SonarSource/sonar-java/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/SonarSource/sonar-java/teams","hooks_url":"https://api.github.com/repos/SonarSource/sonar-java/hooks","issue_events_url":"https://api.github.com/repos/SonarSource/sonar-java/issues/events{/number}","events_url":"https://api.github.com/repos/SonarSource/sonar-java/events","assignees_url":"https://api.github.com/repos/SonarSource/sonar-java/assignees{/user}","branches_url":"https://api.github.com/repos/SonarSource/sonar-java/branches{/branch}","tags_url":"https://api.github.com/repos/SonarSource/sonar-java/tags","blobs_url":"https://api.github.com/repos/SonarSource/sonar-java/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/SonarSource/sonar-java/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/SonarSource/sonar-java/git/refs{/sha}","trees_url":"https://api.github.com/repos/SonarSource/sonar-java/git/trees{/sha}","statuses_url":"https://api.github.com/repos/SonarSource/sonar-java/statuses/{sha}","languages_url":"https://api.github.com/repos/SonarSource/sonar-java/languages","stargazers_url":"https://api.github.com/repos/SonarSource/sonar-java/stargazers","contributors_url":"https://api.github.com/repos/SonarSource/sonar-java/contributors","subscribers_url":"https://api.github.com/repos/SonarSource/sonar-java/subscribers","subscription_url":"https://api.github.com/repos/SonarSource/sonar-java/subscription","commits_url":"https://api.github.com/repos/SonarSource/sonar-java/commits{/sha}","git_commits_url":"https://api.github.com/repos/SonarSource/sonar-java/git/commits{/sha}","comments_url":"https://api.github.com/repos/SonarSource/sonar-java/comments{/number}","issue_comment_url":"https://api.github.com/repos/SonarSource/sonar-java/issues/comments{/number}","contents_url":"https://api.github.com/repos/SonarSource/sonar-java/contents/{+path}","compare_url":"https://api.github.com/repos/SonarSource/sonar-java/compare/{base}...{head}","merges_url":"https://api.github.com/repos/SonarSource/sonar-java/merges","archive_url":"https://api.github.com/repos/SonarSource/sonar-java/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/SonarSource/sonar-java/downloads","issues_url":"https://api.github.com/repos/SonarSource/sonar-java/issues{/number}","pulls_url":"https://api.github.com/repos/SonarSource/sonar-java/pulls{/number}","milestones_url":"https://api.github.com/repos/SonarSource/sonar-java/milestones{/number}","notifications_url":"https://api.github.com/repos/SonarSource/sonar-java/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/SonarSource/sonar-java/labels{/name}","releases_url":"https://api.github.com/repos/SonarSource/sonar-java/releases{/id}","deployments_url":"https://api.github.com/repos/SonarSource/sonar-java/deployments","created_at":"2012-09-04T15:53:13Z","updated_at":"2018-10-24T07:00:27Z","pushed_at":"2018-10-24T07:00:41Z","git_url":"git://github.com/SonarSource/sonar-java.git","ssh_url":"git@github.com:SonarSource/sonar-java.git","clone_url":"https://github.com/SonarSource/sonar-java.git","svn_url":"https://github.com/SonarSource/sonar-java","homepage":"","size":39719,"stargazers_count":399,"watchers_count":399,"language":"Java","has_issues":false,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":281,"mirror_url":null,"archived":false,"open_issues_count":4,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":281,"open_issues":4,"watchers":399,"default_branch":"master"}},"base":{"label":"SonarSource:master","ref":"master","sha":"c1db4b74824d79ea651ebc8329d6459b4118e22d","user":{"login":"SonarSource","id":545988,"node_id":"MDEyOk9yZ2FuaXphdGlvbjU0NTk4OA==","avatar_url":"https://avatars0.githubusercontent.com/u/545988?v=4","gravatar_id":"","url":"https://api.github.com/users/SonarSource","html_url":"https://github.com/SonarSource","followers_url":"https://api.github.com/users/SonarSource/followers","following_url":"https://api.github.com/users/SonarSource/following{/other_user}","gists_url":"https://api.github.com/users/SonarSource/gists{/gist_id}","starred_url":"https://api.github.com/users/SonarSource/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SonarSource/subscriptions","organizations_url":"https://api.github.com/users/SonarSource/orgs","repos_url":"https://api.github.com/users/SonarSource/repos","events_url":"https://api.github.com/users/SonarSource/events{/privacy}","received_events_url":"https://api.github.com/users/SonarSource/received_events","type":"Organization","site_admin":false},"repo":{"id":5674787,"node_id":"MDEwOlJlcG9zaXRvcnk1Njc0Nzg3","name":"sonar-java","full_name":"SonarSource/sonar-java","private":false,"owner":{"login":"SonarSource","id":545988,"node_id":"MDEyOk9yZ2FuaXphdGlvbjU0NTk4OA==","avatar_url":"https://avatars0.githubusercontent.com/u/545988?v=4","gravatar_id":"","url":"https://api.github.com/users/SonarSource","html_url":"https://github.com/SonarSource","followers_url":"https://api.github.com/users/SonarSource/followers","following_url":"https://api.github.com/users/SonarSource/following{/other_user}","gists_url":"https://api.github.com/users/SonarSource/gists{/gist_id}","starred_url":"https://api.github.com/users/SonarSource/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SonarSource/subscriptions","organizations_url":"https://api.github.com/users/SonarSource/orgs","repos_url":"https://api.github.com/users/SonarSource/repos","events_url":"https://api.github.com/users/SonarSource/events{/privacy}","received_events_url":"https://api.github.com/users/SonarSource/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/SonarSource/sonar-java","description":":coffee: SonarJava : Java static analyzer for SonarQube & SonarLint","fork":false,"url":"https://api.github.com/repos/SonarSource/sonar-java","forks_url":"https://api.github.com/repos/SonarSource/sonar-java/forks","keys_url":"https://api.github.com/repos/SonarSource/sonar-java/keys{/key_id}","collaborators_url":"https://api.github.com/repos/SonarSource/sonar-java/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/SonarSource/sonar-java/teams","hooks_url":"https://api.github.com/repos/SonarSource/sonar-java/hooks","issue_events_url":"https://api.github.com/repos/SonarSource/sonar-java/issues/events{/number}","events_url":"https://api.github.com/repos/SonarSource/sonar-java/events","assignees_url":"https://api.github.com/repos/SonarSource/sonar-java/assignees{/user}","branches_url":"https://api.github.com/repos/SonarSource/sonar-java/branches{/branch}","tags_url":"https://api.github.com/repos/SonarSource/sonar-java/tags","blobs_url":"https://api.github.com/repos/SonarSource/sonar-java/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/SonarSource/sonar-java/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/SonarSource/sonar-java/git/refs{/sha}","trees_url":"https://api.github.com/repos/SonarSource/sonar-java/git/trees{/sha}","statuses_url":"https://api.github.com/repos/SonarSource/sonar-java/statuses/{sha}","languages_url":"https://api.github.com/repos/SonarSource/sonar-java/languages","stargazers_url":"https://api.github.com/repos/SonarSource/sonar-java/stargazers","contributors_url":"https://api.github.com/repos/SonarSource/sonar-java/contributors","subscribers_url":"https://api.github.com/repos/SonarSource/sonar-java/subscribers","subscription_url":"https://api.github.com/repos/SonarSource/sonar-java/subscription","commits_url":"https://api.github.com/repos/SonarSource/sonar-java/commits{/sha}","git_commits_url":"https://api.github.com/repos/SonarSource/sonar-java/git/commits{/sha}","comments_url":"https://api.github.com/repos/SonarSource/sonar-java/comments{/number}","issue_comment_url":"https://api.github.com/repos/SonarSource/sonar-java/issues/comments{/number}","contents_url":"https://api.github.com/repos/SonarSource/sonar-java/contents/{+path}","compare_url":"https://api.github.com/repos/SonarSource/sonar-java/compare/{base}...{head}","merges_url":"https://api.github.com/repos/SonarSource/sonar-java/merges","archive_url":"https://api.github.com/repos/SonarSource/sonar-java/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/SonarSource/sonar-java/downloads","issues_url":"https://api.github.com/repos/SonarSource/sonar-java/issues{/number}","pulls_url":"https://api.github.com/repos/SonarSource/sonar-java/pulls{/number}","milestones_url":"https://api.github.com/repos/SonarSource/sonar-java/milestones{/number}","notifications_url":"https://api.github.com/repos/SonarSource/sonar-java/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/SonarSource/sonar-java/labels{/name}","releases_url":"https://api.github.com/repos/SonarSource/sonar-java/releases{/id}","deployments_url":"https://api.github.com/repos/SonarSource/sonar-java/deployments","created_at":"2012-09-04T15:53:13Z","updated_at":"2018-10-24T07:00:27Z","pushed_at":"2018-10-24T07:00:41Z","git_url":"git://github.com/SonarSource/sonar-java.git","ssh_url":"git@github.com:SonarSource/sonar-java.git","clone_url":"https://github.com/SonarSource/sonar-java.git","svn_url":"https://github.com/SonarSource/sonar-java","homepage":"","size":39719,"stargazers_count":399,"watchers_count":399,"language":"Java","has_issues":false,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":281,"mirror_url":null,"archived":false,"open_issues_count":4,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":281,"open_issues":4,"watchers":399,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/SonarSource/sonar-java/pulls/2266"},"html":{"href":"https://github.com/SonarSource/sonar-java/pull/2266"},"issue":{"href":"https://api.github.com/repos/SonarSource/sonar-java/issues/2266"},"comments":{"href":"https://api.github.com/repos/SonarSource/sonar-java/issues/2266/comments"},"review_comments":{"href":"https://api.github.com/repos/SonarSource/sonar-java/pulls/2266/comments"},"review_comment":{"href":"https://api.github.com/repos/SonarSource/sonar-java/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/SonarSource/sonar-java/pulls/2266/commits"},"statuses":{"href":"https://api.github.com/repos/SonarSource/sonar-java/statuses/53edea09a302657a49e92eaf78778d9062a41866"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"christophe-zurn-sonarsource"}}