Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Quotes should be escaped in request logs #12834

Closed
ofrias opened this issue Feb 28, 2025 · 0 comments · Fixed by #12835
Closed

Quotes should be escaped in request logs #12834

ofrias opened this issue Feb 28, 2025 · 0 comments · Fixed by #12835
Assignees
Labels
Bug For general bugs on Jetty side High Priority

Comments

@ofrias
Copy link

ofrias commented Feb 28, 2025

Jetty version(s)
Jetty 12

Jetty Environment
ee10

Java version/vendor
N/A

OS type/version
N/A

Description
Currently quotes are not escaped in the Jetty request log. This is applicable for example to User-Agent field. User agents are not usually quoted but they could be, even maliciously to corrupt logs or break log processing scripts.
Also applicable to Referer field, or in fact any field that comes from the end user.

How to reproduce?
Executing this:
curl -A 'My Quoted " Agent' 'http://localhost:8080/'

Logs this in the user agent field in the request log:
"My Quoted " Agent"

The same on Apache logs this:
"My Quoted \" Agent"

@ofrias ofrias added the Bug For general bugs on Jetty side label Feb 28, 2025
@gregw gregw assigned gregw and unassigned lachlan-roberts Feb 28, 2025
@joakime joakime moved this to 🏗 In progress in Jetty 12.0.17 - FROZEN Feb 28, 2025
@gregw gregw closed this as completed in 921a77e Mar 3, 2025
@github-project-automation github-project-automation bot moved this from 🏗 In progress to ✅ Done in Jetty 12.0.17 - FROZEN Mar 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug For general bugs on Jetty side High Priority
Projects
No open projects
Status: ✅ Done
Development

Successfully merging a pull request may close this issue.

3 participants