Skip to content

Commit dff0772

Browse files
javabeanzjavabeanz
authored
Merge pull request #21 from javabeanz/multi-marker-test
Test masking with multi-markers good job !
2 parents 7fe7982 + e08949d commit dff0772

File tree

4 files changed

+156
-69
lines changed

4 files changed

+156
-69
lines changed

‎owasp-security-logging-log4j/src/main/java/org/owasp/security/logging/log4j/mask/MaskingRewritePolicy.java‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
import org.apache.logging.log4j.core.LogEvent;
1818
import org.apache.logging.log4j.core.appender.rewrite.RewritePolicy;
1919
import org.apache.logging.log4j.core.config.plugins.Plugin;
20+
import org.apache.logging.log4j.core.config.plugins.PluginFactory;
2021
import org.apache.logging.log4j.core.impl.Log4jLogEvent;
2122
import org.apache.logging.log4j.message.Message;
2223
import org.apache.logging.log4j.message.ParameterizedMessage;
@@ -30,7 +31,12 @@
3031
@Plugin(name = "MaskingRewritePolicy", category = "Core", elementType = "rewritePolicy", printObject = true)
3132
public class MaskingRewritePolicy implements RewritePolicy {
3233

33-
private static final Object MASKED_PASSWORD = "********";
34+
public static final Object MASKED_PASSWORD = "********";
35+
36+
@PluginFactory
37+
public static MaskingRewritePolicy createPolicy() {
38+
return new MaskingRewritePolicy();
39+
}
3440

3541
/**
3642
* Rewrite the event.
@@ -40,6 +46,7 @@ public class MaskingRewritePolicy implements RewritePolicy {
4046
* logging event.
4147
* @return The LogEvent after rewriting.
4248
*/
49+
@Override
4350
public LogEvent rewrite(LogEvent source) {
4451
// get the markers for the log event. If no markers, nothing can be
4552
// tagged confidential and we can return

‎owasp-security-logging-log4j/src/test/java/org/owasp/security/logging/log4j/mask/MaskingRewritePolicyTest.java‎

Lines changed: 116 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,22 @@
88
import org.apache.logging.log4j.core.LogEvent;
99
import org.apache.logging.log4j.core.impl.Log4jLogEvent;
1010
import org.apache.logging.log4j.core.impl.Log4jLogEvent.Builder;
11+
import org.apache.logging.log4j.junit.InitialLoggerContext;
1112
import org.apache.logging.log4j.message.Message;
1213
import org.apache.logging.log4j.message.ParameterizedMessage;
1314
import org.apache.logging.log4j.message.SimpleMessage;
15+
import org.apache.logging.log4j.test.appender.ListAppender;
16+
import org.junit.After;
17+
import static org.junit.Assert.assertEquals;
18+
import static org.junit.Assert.assertNotSame;
19+
import static org.junit.Assert.assertTrue;
20+
import org.junit.Before;
21+
import org.junit.ClassRule;
22+
import org.junit.FixMethodOrder;
23+
import org.junit.Test;
24+
import org.junit.runners.MethodSorters;
1425
import org.owasp.security.logging.SecurityMarkers;
26+
import org.slf4j.LoggerFactory;
1527

1628
/**
1729
* The class <code>MaskingRewritePolicyTest</code> contains tests for the class
@@ -25,79 +37,118 @@
2537
*
2638
* @version $Revision$
2739
*/
28-
public class MaskingRewritePolicyTest extends TestCase {
40+
public class MaskingRewritePolicyTest {
2941

30-
/**
31-
* Construct new test instance
32-
*
33-
* @param name
34-
* the test name
35-
*/
36-
public MaskingRewritePolicyTest(String name) {
37-
super(name);
38-
}
42+
private static final String CONFIG = "log4j2.xml";
3943

40-
public void testRewriteConfidentialNoParams() {
41-
MaskingRewritePolicy fixture = new MaskingRewritePolicy();
42-
Marker marker = new MarkerManager.Log4jMarker(
43-
SecurityMarkers.CONFIDENTIAL.getName());
44-
Log4jLogEvent event = createEvent(marker, new SimpleMessage());
45-
LogEvent result = fixture.rewrite(event);
46-
assertEquals(event, result);
47-
}
44+
private static final org.slf4j.Logger LOGGER = LoggerFactory
45+
.getLogger(MaskingRewritePolicyTest.class);
4846

49-
public void testRewriteConfidentialWithParams() {
50-
MaskingRewritePolicy fixture = new MaskingRewritePolicy();
51-
Marker marker = new MarkerManager.Log4jMarker(
52-
SecurityMarkers.CONFIDENTIAL.getName());
53-
Message message = new ParameterizedMessage("ddd", "gladiator");
54-
LogEvent event = createEvent(marker, message);
55-
LogEvent result = fixture.rewrite(event);
56-
assertNotSame(event, result);
57-
}
47+
private static final String SSN = "123-45-6789";
5848

59-
public void testRewriteNotConfidential() {
60-
MaskingRewritePolicy fixture = new MaskingRewritePolicy();
61-
Marker marker = new MarkerManager.Log4jMarker(
62-
SecurityMarkers.EVENT_FAILURE_MARKER_NAME);
63-
Message message = new ParameterizedMessage("ddd", "gladiator");
64-
LogEvent event = createEvent(marker, message);
65-
LogEvent result = fixture.rewrite(event);
66-
assertEquals(event, result);
67-
}
49+
@ClassRule
50+
public static InitialLoggerContext context = new InitialLoggerContext(CONFIG);
6851

69-
public void testRewriteConfidentialWithZeroParams() {
70-
MaskingRewritePolicy fixture = new MaskingRewritePolicy();
71-
Marker marker = new MarkerManager.Log4jMarker(
72-
SecurityMarkers.CONFIDENTIAL.getName());
73-
Message message = new ParameterizedMessage("ddd", null);
74-
LogEvent event = createEvent(marker, message);
75-
LogEvent result = fixture.rewrite(event);
76-
assertEquals(event, result);
77-
}
52+
ListAppender appender;
7853

79-
public void testRewriteConfidentialNoMessage() {
80-
MaskingRewritePolicy fixture = new MaskingRewritePolicy();
81-
Marker marker = new MarkerManager.Log4jMarker(
82-
SecurityMarkers.CONFIDENTIAL.getName());
83-
Log4jLogEvent event = createEvent(marker, null);
84-
LogEvent result = fixture.rewrite(event);
85-
assertEquals(event, result);
54+
@Before
55+
public void setUp() {
56+
System.out.println("CONTEXT: " + context);
57+
appender = context.getListAppender("List");
8658
}
8759

88-
public void testRewriteNoMarker() {
89-
MaskingRewritePolicy fixture = new MaskingRewritePolicy();
90-
Message message = new ParameterizedMessage("ddd", "gladiator");
91-
Log4jLogEvent event = createEvent(null, message);
92-
LogEvent result = fixture.rewrite(event);
93-
assertEquals(event, result);
94-
}
60+
@After
61+
public void tearDown() {
62+
appender.clear();
63+
}
64+
65+
@Test
66+
public void testRewriteMultiMarker() {
67+
System.out.println("running testRewriteMultiMarker()");
68+
org.slf4j.Marker multiMarker = SecurityMarkers.getMarker(SecurityMarkers.CONFIDENTIAL, SecurityMarkers.SECURITY_FAILURE);
69+
70+
// test a logging event with the multi-marker
71+
LOGGER.info(multiMarker, "ssn={}", SSN);
72+
LogEvent failEvent = appender.getEvents().get(0);
73+
Message message = failEvent.getMessage();
74+
75+
System.out.println("Formatted message: " + message.getFormattedMessage());
76+
assertTrue(message.getFormattedMessage().contains("ssn=" + MaskingRewritePolicy.MASKED_PASSWORD));
77+
}
78+
79+
/**
80+
* This test case has the CONFIDENTIAL marker so the results should be masked
81+
*/
82+
@Test
83+
public void testRewriteConfidentialWithParams() {
84+
System.out.println("running testRewriteConfidentialWithParams()");
85+
86+
// test a logging event with the CONFIDENTIAL marker
87+
LOGGER.info(SecurityMarkers.CONFIDENTIAL, "ssn={}", SSN);
88+
LogEvent failEvent = appender.getEvents().get(0);
89+
Message message = failEvent.getMessage();
90+
91+
System.out.println("Formatted message: " + message.getFormattedMessage());
92+
assertTrue(message.getFormattedMessage().contains("ssn=" + MaskingRewritePolicy.MASKED_PASSWORD));
93+
}
94+
95+
/**
96+
* This test case has the CONFIDENTIAL marker, but it is not parameterized
97+
* so masking cannot take place.
98+
*/
99+
@Test
100+
public void testRewriteConfidentialNoParams() {
101+
System.out.println("running testRewriteConfidentialNoParams()");
102+
103+
// test a logging event with the CONFIDENTIAL marker
104+
LOGGER.info(SecurityMarkers.CONFIDENTIAL, "ssn=" + SSN);
105+
LogEvent failEvent = appender.getEvents().get(0);
106+
Message message = failEvent.getMessage();
107+
108+
System.out.println("Formatted message: " + message.getFormattedMessage());
109+
assertTrue(message.getFormattedMessage().contains("ssn=" + SSN));
110+
}
111+
112+
/**
113+
* This test case is parameterized, but does not have the CONFIDENTIAL
114+
* marker, so it should not be masked
115+
*/
116+
@Test
117+
public void testRewriteNotConfidential() {
118+
System.out.println("running testRewriteSingleMarker()");
119+
120+
// test a logging event with the CONFIDENTIAL marker
121+
LOGGER.info(SecurityMarkers.SECURITY_SUCCESS, "ssn={}", SSN);
122+
LogEvent failEvent = appender.getEvents().get(0);
123+
Message message = failEvent.getMessage();
124+
125+
System.out.println("Formatted message: " + message.getFormattedMessage());
126+
assertTrue(message.getFormattedMessage().contains("ssn=" + SSN));
127+
}
128+
129+
@Test
130+
public void testRewriteNoMarker() {
131+
System.out.println("running testRewriteNoMarker()");
132+
133+
// test a logging event with no marker
134+
LOGGER.info("ssn={}", SSN);
135+
LogEvent failEvent = appender.getEvents().get(0);
136+
Message message = failEvent.getMessage();
137+
138+
System.out.println("Formatted message: " + message.getFormattedMessage());
139+
assertTrue(message.getFormattedMessage().contains("ssn=" + SSN));
140+
}
141+
142+
@Test
143+
public void testRewriteConfidentialNoMessage() {
144+
System.out.println("running testRewriteConfidentialNoMessage()");
95145

96-
private Log4jLogEvent createEvent(Marker marker, Message message) {
97-
Log4jLogEvent.Builder builder = new Builder();
98-
builder.setMarker(marker).setLevel(Level.DEBUG).setLoggerName("jjj")
99-
.setLoggerFqcn("ggg").setMessage(message);
100-
Log4jLogEvent event = builder.build();
101-
return event;
146+
// test a logging event with null marker
147+
LOGGER.info(null);
148+
LogEvent failEvent = appender.getEvents().get(0);
149+
Message message = failEvent.getMessage();
150+
151+
System.out.println("Formatted message: " + message.getFormattedMessage());
152+
assertTrue(message.getFormattedMessage() == null);
102153
}
103154
}

‎owasp-security-logging-log4j/src/test/resources/log4j2.xml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,16 @@
1111
</Filters>
1212
</Console>
1313
<List name="List"></List>
14-
</Appenders>
15-
<Loggers>
16-
<Root level="debug">
14+
<Rewrite name="MaskingRewritePolicy">
15+
<MaskingRewritePolicy />
1716
<AppenderRef ref="Console"/>
1817
<AppenderRef ref="SecureConsole"/>
1918
<AppenderRef ref="List"/>
19+
</Rewrite>
20+
</Appenders>
21+
<Loggers>
22+
<Root level="debug">
23+
<AppenderRef ref="MaskingRewritePolicy"/>
2024
</Root>
2125
</Loggers>
2226
</Configuration>

‎owasp-security-logging-logback/src/test/java/org/owasp/security/logging/mask/MaskingConverterTest.java‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@
4141
import org.mockito.runners.MockitoJUnitRunner;
4242
import org.owasp.security.logging.SecurityMarkers;
4343
import org.slf4j.LoggerFactory;
44+
import org.slf4j.Marker;
4445

4546
/**
4647
*
@@ -109,4 +110,28 @@ public void test() {
109110
assertFalse(layoutMessage.contains("secret"));
110111
}
111112

113+
/**
114+
* Test that masking works for combinations of markers and not just
115+
* SecurityMarkers.CONFIDENTIAL
116+
*
117+
* @see https://github.com/javabeanz/owasp-security-logging/issues/19
118+
*/
119+
@Test
120+
public void markerTest() {
121+
Marker multiMarker = SecurityMarkers.getMarker(SecurityMarkers.CONFIDENTIAL, SecurityMarkers.SECURITY_FAILURE);
122+
123+
String ssn = "123-45-6789";
124+
LOGGER.info(multiMarker, "ssn={}", ssn);
125+
126+
// Now verify our logging interactions
127+
verify(mockAppender).doAppend(captorLoggingEvent.capture());
128+
129+
// Get the logging event from the captor
130+
final LoggingEvent loggingEvent = captorLoggingEvent.getValue();
131+
132+
// Check the message being logged is correct
133+
String layoutMessage = encoder.getLayout().doLayout(loggingEvent);
134+
assertTrue(layoutMessage.contains("ssn=" + MaskingConverter.MASKED_PASSWORD));
135+
}
136+
112137
}

0 commit comments

Comments
 (0)