英文:
getting error in rest api while logging the response
问题
以下是您提供的代码部分的翻译：
我有以下的 Java 代码，其中我使用了一个 RestTemplate 来交换一些数据，并从第三方服务获取响应，如下所示：
ResponseEntity<String> response = restTemplate.exchange(restApiUrl,
HttpMethod.POST, entity, String.class);
LOGGER.info("来自UIDAI的XML响应：" + response.getBody()); //** 错误**//
但在使用 Fortify 进行扫描时，它显示在 Java 类中的 restTemplateCall() 方法将未经验证的用户输入写入日志。攻击者可以利用此行为伪造日志条目或将恶意内容注入日志中。
请指导如何解决这个问题。
英文:
I have the below java code in which i making use of an rest template to exchange some data and getting response from third party service as shown below
ResponseEntity<String> response = restTemplate.exchange(restApiUrl,
HttpMethod.POST, entity, String.class);
LOGGER.info("XML Response from UIDAI :" + response.getBody()); //** Error**//
but upon scanning with fortify it is showing he method restTemplateCall() in java class writes unvalidated user input to the log . An attacker could take advantage of this behavior to forge log entries or inject malicious content into the log
Please advise how to overcome from this .
专注分享java语言的经验与见解，让所有开发者获益！
评论