log forging

Posted 2020-12-27 lihongling

为了防止日志攻击，我们一般采用在打印日志的地方过滤，过滤方法如下：

 

public static String validLog(String log) {
    List<String> list = new ArrayList<>();
    list.add("%0d");
    list.add("
");
    list.add("%0a");
    list.add("
");
    String encode = Normalizer.normalize(log, Normalizer.Form.NFKC);
    for (int i = 0; i < list.size(); i++) {
        encode = encode.replace(list.get(i), "");
    }
    return encode;
}