8

In my current project I am using Maven and Spring. I am currently using SLF4J logger for logging services. In place of that I want to use OWASP-ESAPI logger. I don't want to use OWASP-ESAPI security, just the log services. Can anybody please guide me how to use OWASP-ESAPI logger by replacing slf4j logger with minimum efforts ? I tried a lot of google search but nothing helps. I will really appreciate some links to gain knowledge about OWASP-ESAPI logger as well.

Gnanam
  • 10,613
  • 19
  • 54
  • 72
Amit
  • 152
  • 1
  • 2
  • 12

2 Answers2

5

Refactoring your code to remove slf4j is a horrific solution, because then you lose the ability to capture JUL, JCL, LOG4J traffic into a common log funnel. The prior response is bad advice.

  1. You can enable ESAPI to use JUL Logging, and then, by using JUL over SLF4J, recapture that log traffic and route to other loggers (i.e. log4j or logback). To do so, in ESAPI.properties: ESAPI.Logger=org.owasp.esapi.reference.JavaLogFactory

  2. Another option would be to build an SLF4J logger proxy over the ESAPI Logger Interface. I think you lose more functionality than you gain in this case.

Jim Doyle
  • 106
  • 1
  • 5
  • thanks for the response, we dropped OWASP ESAPI logger a long ago – Amit Oct 01 '15 at 07:01
  • Bad advice depending on the application. The project I was working on back when I wrote this was primarily log4j with a little slf4j. So converting everything over to ESAPI logging just made sense. We had no need for a common log funnel. I like your first option. – avgvstvs Nov 04 '15 at 16:22
  • If someone is still reading this, I want to understand the first option here. I understand it. Will it allow us to use the default slf4j interface, but filter log output through the esapi html filter? I need specifics. – David M. Karr Oct 11 '19 at 21:36
  • I am using `ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory` in ESAPI.properties. I use ESAPI logger where security flags are raised (for example, by static analysis tools) - usually in authentication and authorization modules. I use slf4j logger in rest of the application. – Ritesh Apr 25 '21 at 15:19
1

The key thing to note is that ESAPI is only build for log4j or commons java.util logging. I'm assuming log4j.

Step 1: Remove the slf4j library from your classpath. If you're using an IDE, this should "christmas-tree" your application and tell you everything you have to change.

Step 2: Add esapi to the classpath

Step 3: Manually convert all of your slf4j logging calls to their new ESAPI counterpart. You'll grab a reference to the esapi logger like this:

Logger logger = ESAPI.getLogger("my.foo.class.Foo");

With the information provided, this is pretty straightforward.

NOTE: Log4j doesn't support some of the formatting calls that slfj supports. This will result in you either manually re-creating the input OR holding off on all those instances until later and then still using slf4j but just using the [MessageFormatter][1] to pass in the log input.

avgvstvs
  • 6,196
  • 6
  • 43
  • 74
  • As a side note, as of 2020 ESAPI quit using log4j as its default logging setup and defaults to JUL. This answer maybe has some historical relevance, but it fully supports slf4j in its more recent versions so I would give none of this advice today. – avgvstvs Dec 27 '21 at 17:54