CX Log_Forging @ src/main/java/org/joychou/security/HttpFilter.java [master] #74

Log_Forging issue exists @ src/main/java/org/joychou/security/HttpFilter.java in branch master

Method doFilter at line 36 of src\main\java\org\joychou\security\HttpFilter.java gets user input from element getRequestURL. This element’s value flows through the code without being properly sanitized or validated, and is eventually used in writing an audit log in doFilter at line 36 of src\main\java\org\joychou\security\HttpFilter.java.
This may enable Log Forging.

Severity: Low

CWE:117

Vulnerability details and guidance

Internal Guidance

Checkmarx

Lines: 42 59

Code (Line #42):

        String refer = request.getHeader("referer");

Code (Line #59):

                            logger.info("[-] URL: " + request.getRequestURL() + "?" + request.getQueryString() + "\t"