The apache server documentation states that log files may contain information

Question

The apache server documentation states that log files may contain information

supplied directly by the client, without escaping. Therefore, it is possible for malicious clients to insert control-characters in the log files, so care must be taken in dealing with raw logs.

What is the preferred solution of this problem?

0

01.03.2022

7 ответов

25 просмотров

Martin Rys

Don't cat logs I guess

0

02.03.2022

Bread pup ▲⬤ ×▫︎

Sounds familiar 🤔 log4j?

0

02.03.2022

shmshd

use Nginx? Do they state same in the docs?

0

02.03.2022

Alexander Gnatyuk Автор вопроса

Bread pup ▲⬤ ×▫︎
Sounds familiar 🤔 log4j?

log4j vulnerability was about recursive evaluation of templated log strings. This is simpler - client puts something weird in user agent or requested URL and this messes with your terminal or software you use to parse logs.

0

02.03.2022

Alexander Gnatyuk Автор вопроса

shmshd
use Nginx? Do they state same in the docs?

If I were to change software every time it did something incorrectly, I'd run out of software very quickly 😅

0

02.03.2022

shmshd

Alexander Gnatyuk
If I were to change software every time it did som...

✅

0

02.03.2022