Mailing-List: contact dev-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Developers List" <dev@tomcat.apache.org>
From: bugzilla@apache.org
To: tomcat-dev@jakarta.apache.org
Subject: DO NOT REPLY [Bug 37480]  -
    Log forging possible
Message-Id: <20051112221700.7536FDE@ajax.apache.org>
Date: Sat, 12 Nov 2005 23:17:00 +0100 (CET)

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=37480>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=37480


markt@apache.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|Catalina                    |Webapps:Examples


------- Additional Comments From markt@apache.org  2005-11-12 23:16 -------
Apart from the example webapp, all code paths listed in this report that exhibit
this issue require that debug level logging is enabled.

Whether or not to encode debug level log messages is a trade off between a low
risk vulnerability - difficult to attack without being spotted(1) and a low
impact(2) - and the risk of causing developer issues when reading debug messages
as well as adding complexity to the logging code.

Having debugged a fair number of i18n issues in Tomcat, I'd much rather have
un-encoded log output.

(1) You don't know which debug logging is turned on where and at what level, the
message may get logged by multiple components with different message formats,
you need to get the timestamp right etc

(2) Could be used to disguise another attack but in itself does not actually do
any harm.


Therefore, I am changing the component for this issue to the examples webapp.

-- 
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org