-1
LOGGER.debug("response" + SecurityUtils.htmlEscape(result.toString()));

Veracode Issue: Improper Output Neutralization for Logs

Why veracode still detects a bug in the above line?

Filburt
  • 17,626
  • 12
  • 64
  • 115
Chaithra S
  • 31
  • 1

2 Answers2

0

Removed the loggers where we are logging unnecessary request and response.

And for Other loggers statements: Issue fixed , instead of encoding the value, we have used ESAPI logger to log statements.

Chaithra S
  • 31
  • 1
0

Here is the correct syntax:

LOGGER.debug("response" + WebUtility.HtmlEncode(Convert.ToString(result)));

Yash
  • 1
  • As it’s currently written, your answer is unclear. Please [edit] to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Jul 24 '22 at 01:06