0

I am currently struggling with masking the data available in the logs intercepted at the SOAP client. I have taken the approach to writing customized PatternLayout:

public class PatternMaskingLayout extends ch.qos.logback.classic.PatternLayout {

private Pattern multilinePattern;
private final List<String> maskPatterns = new ArrayList<>();

public void addMaskPattern(String maskPattern) {
    maskPatterns.add(maskPattern);
    multilinePattern = Pattern.compile(
            String.join("|", maskPatterns),
            Pattern.MULTILINE
    );
}

@Override
public String doLayout(ILoggingEvent event) {
    return maskMessage(super.doLayout(event)); // calling superclass method is required
}

private String maskMessage(String message) {
    if (multilinePattern == null) {
        return message;
    }
    StringBuilder sb = new StringBuilder(message);
    Matcher matcher = multilinePattern.matcher(sb);
    while (matcher.find()) {
        IntStream.rangeClosed(1, matcher.groupCount()).forEach(group -> {
            if (matcher.group(group) != null) {
                IntStream.range(matcher.start(group), matcher.end(group))
                        .forEach(i -> sb.setCharAt(i, '*')); // replace each character with asterisk
            }
        });
    }
    return sb.toString();
}

}

My logback-spring.xml appenders looks like:

        <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
        <layout class="app.example.monitoring.tracing.PatternMaskingLayout">
            <maskPattern>\"username\"\s*:\s*\"(.*?)\"</maskPattern>
            <pattern>
                ${LOGBACK_LOGGING_PATTERN:-%d{yyyy-MM-dd HH:mm:ss.SSS} ${LOG_LEVEL_PATTERN:-%5p} ${PID:- } --- [%15.15t] %logger{36} : %msg %replace(%ex){'\n','\\u000a'}%nopex%n}
            </pattern>
        </layout>
    </appender>

I still can not get my username masked. The XML field looks like <xa2:username>John</xa2:username>|

Have anyone have some experience with this?

Dariusz Mozgowoj
  • 46
  • 5
  • You can try using OWASP security logging. Ref: https://github.com/javabeanz/owasp-security-logging – Haridarshan Jun 11 '21 at 11:41
  • @Haridarshan it seems that it works only with predefined SecurityMarkers. I do not want to mark places with LOGGER I am using interceptor so it should allow me to use any patterns inside log back to do so. – Dariusz Mozgowoj Jun 11 '21 at 12:14
  • Did you found any solution for this requirement? If you have the solution, also post for year masking from dd/mm/yyyy format. – Nallamachu May 19 '22 at 10:29

0 Answers0