응용 프로그램 서버가있는 ESAPI 로거

Question

유효성 확인을 위해 ESAPI jar를 사용했습니다. 내가 isValidInput (Context, input.trim(), ValidateConstant.APLHA_NUMERIC_TYPE, maxLength, true)를 호출 할 때; 또는 isValidInput (Context, input, ValidateConstant.NUMERIC_TYPE, maxLength, true); 입력이 특수 문자로 잘못되었습니다. 는 내가 혼자 스탠드 프로그램을 실행할 때

org.owasp.esapi.errors.ValidationException: input: Invalid input. Please conform to regex ^[0-9]*$ with a maximum length of 15 
    at org.owasp.esapi.reference.validation.StringValidationRule.checkWhitelist(StringValidationRule.java:144) 
    at org.owasp.esapi.reference.validation.StringValidationRule.checkWhitelist(StringValidationRule.java:160) 
    at org.owasp.esapi.reference.validation.StringValidationRule.getValid(StringValidationRule.java:284) 
    at org.owasp.esapi.reference.DefaultValidator.getValidInput(DefaultValidator.java:214) 
    at org.owasp.esapi.reference.DefaultValidator.isValidInput(DefaultValidator.java:152) 
    at org.owasp.esapi.reference.DefaultValidator.isValidInput(DefaultValidator.java:143) 

이 같은 몇 가지가 표시되어 발생합니다.

이 예외를 내 applicaion server.log 파일에 통합하는 방법은 무엇입니까?

Answer 1

IntrusionDetector.org.owasp.esapi.errors.IntegrityException.actions은 = 해제, 로그

# rapid validation errors indicate scans or attacks in progress 
# org.owasp.esapi.errors.ValidationException.count=10 
# org.owasp.esapi.errors.ValidationException.interval=10 
# org.owasp.esapi.errors.ValidationException.actions=log,logout 

# sessions jumping between hosts indicates session hijacking 
IntrusionDetector.org.owasp.esapi.errors.AuthenticationHostException.count=2 
IntrusionDetector.org.owasp.esapi.errors.AuthenticationHostException.interval=10 
IntrusionDetector.org.owasp.esapi.errors.AuthenticationHostException.actions=log,logout 


#=========================================================================== 
# ESAPI Validation 
# 
# The ESAPI Validator works on regular expressions with defined names. You can define names 
# either here, or you may define application specific patterns in a separate file defined below. 
# This allows enterprises to specify both organizational standards as well as application specific 
# validation rules.