You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Description
Currently quotes are not escaped in the Jetty request log. This is applicable for example to User-Agent field. User agents are not usually quoted but they could be, even maliciously to corrupt logs or break log processing scripts.
Also applicable to Referer field, or in fact any field that comes from the end user.
How to reproduce?
Executing this: curl -A 'My Quoted " Agent' 'http://localhost:8080/'
Logs this in the user agent field in the request log: "My Quoted " Agent"
The same on Apache logs this: "My Quoted \" Agent"
The text was updated successfully, but these errors were encountered:
Jetty version(s)
Jetty 12
Jetty Environment
ee10
Java version/vendor
N/A
OS type/version
N/A
Description
Currently quotes are not escaped in the Jetty request log. This is applicable for example to
User-Agent
field. User agents are not usually quoted but they could be, even maliciously to corrupt logs or break log processing scripts.Also applicable to
Referer
field, or in fact any field that comes from the end user.How to reproduce?
Executing this:
curl -A 'My Quoted " Agent' 'http://localhost:8080/'
Logs this in the user agent field in the request log:
"My Quoted " Agent"
The same on Apache logs this:
"My Quoted \" Agent"
The text was updated successfully, but these errors were encountered: