We Keep Coding

Veracode CWE ID 117, improper log neutralization not working

I have a lot of issue with CWE 117 in Veracode with my Java project.
I tried to fix it without code by using log configuration.
I add the dependency
<!-- https://mvnrepository.com/artifact/org.owasp/security-logging-logback -->
<dependency>
<groupId>org.owasp</groupId>
<artifactId>security-logging-logback</artifactId>
<version>1.1.7</version>
</dependency>
I add the conversion
<!-- Define the CRLFConverter -->
<conversionRule conversionWord="crlf" converterClass="org.owasp.security.logging.mask.CRLFConverter" />
I add the pattern in my layout
%crlf(%.-500msg)
I made the change in the logback.xml file in the resource folder.
I run another scan but the issues are still there.
Any idea why this is not fixing the CWE?
Thanks,
Nicolas

Get sessionCookieName from ServletContext in context.xml of tomcat

How could I get the name of session of current request?
The default name of tomcat session is "jsessionid". Given that I have modified the sessionCookieName configuration in context.xml of tomcat as below to gives multiple tomcat instance run on a same server
<Context sessionCookieName="appSessionId">
<!-- Default set of monitored resources. If one of these changes, the -->
<!-- web application will be reloaded. -->
<WatchedResource>WEB-INF/web.xml</WatchedResource>
<WatchedResource>${catalina.base}/conf/web.xml</WatchedResource>
<!-- Uncomment this to disable session persistence across Tomcat restarts -->
<!--
<Manager pathname="" />
-->
<!-- Uncomment this to enable Comet connection tacking (provides events
on session expiration as well as webapp lifecycle) -->
<!--
<Valve className="org.apache.catalina.valves.CometConnectionManagerValve" />
-->
</Context>
My web app need to know what the name of session of current request is. I have tried such as:
request.getServletContext().getSessionCookieConfig().getName()
request.getSession().getServletContext().getSessionCookieConfig().getName()
But both of them are null.
My pom.xml as below
<dependency>
<groupId>javax.servlet</groupId>
<artifactId>javax.servlet-api</artifactId>
<version>3.0.1</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat</groupId>
<artifactId>tomcat-catalina</artifactId>
<version>8.0.23</version>
</dependency>
The tomcat I have used is also 8.0.23, any help is appreciated.

This is pretty confusing, because from what I can tell the following always return null, so I'm not sure what the point in them is!
request.getServletContext().getSessionCookieConfig().getName()
request.getSession().getServletContext().getSessionCookieConfig().getName()
You need to do:
SessionConfig.getSessionCookieName(request.getContext())

Flex AMF Data/Services Error

After stumbling my way through setting up a BlazeDS service, I was finally able to get the list of services through the Flex Builder Data/Services Wizzard. However when testing any of the services, I get the Error popup of
> "InvocationTargetException:There was an error while invoking the
> operation. Check your operation inputs or server code and try invoking
> the operation again.
>
> Reason: java.io.FileNotFoundException:
> http://127.0.0.1:8080/portlets-0.0.1-SNAPSHOT/messagebroker/amf/
I could not find anyone else with a similar issue, and am unfamiliar with services setup. Below are my configurations. Any help would be greatly appreciated.
I can post config files if it will help, i was getting improper code format errors trying to insert them in this single post.
This service I am testing does not reach the function in the server, it is throwing this error before getting that far...
I have also noticed that I cannot run the flex application through a web browser using the standard run configuration in eclipse as it tries to target:
[http://127.0.0.1:8080/portlets-0.0.1-SNAPSHOT/messagebroker/amf/FlexMissionsOverview/MissionsPortlet.html][1]
Which throws a 404 error on tomcat since the file does not exist there. Are these possibly connected?
Any help would be greatly appreciated.
Added Details based on feedback:
Yes, the project name is "FlexMissionsOverview" with a Base Flex Application Called "MissionsPortlet"(.mxml).
The webapp is deployed to "webapps/portlets-0.0.1-SNAPSHOT/"
Compiler settings below:
-services "C:\liferay\liferay-portal-6.1.1-ce-ga2\tomcat-7.0.27\webapps\portlets-0.0.1-SNAPSHOT\WEB-INF\flex\services-config.xml" -locale en_US
-show-deprecation-warnings=false
-show-binding-warnings=false
Note: I am setting my project back up to where I had gotten to by the time of this post, if anything changes I will make another edit.
services-config.xml
<?xml version="1.0" encoding="UTF-8"?>
<services-config>
<services>
<service-include file-path="remoting-config.xml" />
<service-include file-path="proxy-config.xml" />
<service-include file-path="messaging-config.xml" />
</services>
<factories>
<factory id="spring" class="flex.samples.factories.SpringFactory"/>
</factories>
<services>
<service id="remoting-service" class="flex.messaging.services.RemotingService">
<adapters>
<adapter-definition id="java-object"
class="flex.messaging.services.remoting.adapters.JavaAdapter"
default="true" />
</adapters>
<default-channels>
<channel ref="my-amf" />
</default-channels>
</service>
</services>
<channels>
<channel-definition id="my-amf"
class="mx.messaging.channels.AMFChannel">
<endpoint
url="http://{server.name}:{server.port}/{context.root}/messagebroker/amf"
class="flex.messaging.endpoints.AMFEndpoint" />
<properties>
<add-no-cache-headers>false</add-no-cache-headers>
<polling-enabled>false</polling-enabled>
</properties>
</channel-definition>
</channels>
<logging>
<!-- You may also use flex.messaging.log.ServletLogTarget -->
<target class="flex.messaging.log.ConsoleTarget" level="Error">
<properties>
<prefix>[BlazeDS] </prefix>
<includeDate>false</includeDate>
<includeTime>false</includeTime>
<includeLevel>true</includeLevel>
<includeCategory>false</includeCategory>
</properties>
<filters>
<pattern>Endpoint.</pattern>
<pattern>Service.</pattern>
<pattern>Configuration</pattern>
</filters>
</target>
</logging>
</services-config>
Pointing to the file directly on the tomcat server seems to work fine for testing the Flex Application via Eclipse, but I am still getting the same "FileNotFoundException" When trying to test the BlazeDS Services in the Data/Services Wizard in FlashBuilder.
Is there any indication of what the FileNotFoundException is coming from when trying to test the services? It may be some of the config information, but I am not positive, since I am used to these Exceptions saying what file it could not find.
The only class that I have in my project that is referenced above is the two listener classes, the other classes I believe come from my maven dependencies.

Eclipse and GWT looking for inherited module in wrong package, despite gwt.xml file having correct path?

Upon attempting to run my Google Web Application I've been working on in Eclipse using GWT, it gives me this error:
"Loading modules
com.example.pbot.Pbot
Loading inherited module 'com.example.pbot.Pbot'
[ERROR] Unable to find 'com/example/pbot/Pbot.gwt.xml' on your classpath; could be a typo, or maybe you forgot to include a classpath entry for source?
[ERROR] shell failed in doStartup method"
All of my packages are com.pbot, com.pbot.client, com.pbot.server, etc; I don't know where it's seeing com.example.
The entry-point class in the gwt.xml file is com.pbot.client.Pbot, which is my entry point class. Here's the full gwt.xml:
-->
<!DOCTYPE module PUBLIC "-//Google Inc.//DTD Google Web Toolkit 2.5.1//EN"
"http://google-web-toolkit.googlecode.com/svn/tags/2.5.1/distro-source/core/src/gwt-module.dtd">
<module rename-to='pbot'>
<!-- Inherit the core Web Toolkit stuff. -->
<inherits name='com.google.gwt.user.User'/>
<!-- Inherit the default GWT style sheet. You can change -->
<!-- the theme of your GWT application by uncommenting -->
<!-- any one of the following lines. -->
<inherits name='com.google.gwt.user.theme.clean.Clean'/>
<!-- <inherits name='com.google.gwt.user.theme.standard.Standard'/> -->
<!-- <inherits name='com.google.gwt.user.theme.chrome.Chrome'/> -->
<!-- <inherits name='com.google.gwt.user.theme.dark.Dark'/> -->
<!-- Other module inherits -->
<!-- Specify the app entry point class. -->
<entry-point class='com.pbot.client.Pbot'/>
<!-- Specify the paths for translatable code -->
<source path='client'/>
<source path='shared'/>
</module>
I've cleaned, refreshed and restarted the project, I don't know what else to do. Where is it reading "com.example?" Please help!

Check the run configurations -> Arguments. There will be a reference of com.example.pbot.Pbot.
I think, this is what Thomas mentioned.

Check the project properties, in the GWT page, it probably references the com.example that you initially created.

How to create a development/debug and production setup

I recently deployed inadvertently a debug version of our game typrX
(typing races at www.typrx.com - try it it's fun).
It was quickly corrected but I know it may happen again. After digging
on Google I found some info how to create 2 different profiles, one
for development mode that has the debug functions and one used for
deployment. Here is what I found from a Google IO presentation. Does
anyone have this setup? Can someone explains how to run this?
MyAppCommon.gwt.xml
<module>
...
<define-property values="debug, release" name="app.config" />
<replace-with class="myapp.debug.DebugConsole">
<when-type-is class="myapp.Console" />
<when-property-is name="app.config" value="debug" />
</replace-with>
...
</module>
MyAppDebug.gwt.xml
<module>
...
<set-property name="app.config" value="debug" />
</module>

The idea of using a specific module for debugging has been floating around for some times, and was also mentioned in this Google I/O presentation (see slide 33 from PDF or at 0h31m in the video).
The basic idea is that you have a standard GWT module, and a second debug module that inherits this standard module, configures some properties, and uses GWT's deferred binding to replace some classes with specific instances when debugging.
Then, you only have to configure your Maven / ant build to compile the appropriate module depending on wether you are in development mode or in release mode.
In my project, I did not create an "app.config" deferred binding property, but I might do that later on. What I did was the following:
Created a standard module
com/example/MainModule.gwt.xml:
<module rename-to="mainModule">
<inherits name="com.smartgwt.SmartGwt" />
<!-- (other configurations) -->
<!-- gwt-log configuration -->
<define-property name="log_level" values="OFF,DEBUG" />
<inherits name="com.allen_sauer.gwt.log.gwt-log-common" />
<!-- Locales we want to compile for -->
<extend-property name="locale" values="en" />
<extend-property name="locale" values="fr_FR" />
</module>
Created a "debug" module, that inherits the standard module and configures some additional properties for development
com/example/MainModuleDebug.gwt.xml:
<module rename-to="mainModule">
<inherits name="com.example.MainModule" />
<set-property name="user.agent" value="gecko1_8" />
<set-property name="locale" value="fr_FR"/>
<set-property name="log_level" value="DEBUG" />
</module>
Note: the rename-to attribute is very important here, since you want both modules to be deployed under the exact same name. When you compile during development, you do not want to have to change all your html host pages to point to the debug module.
Configured Maven and the gwt-maven-plugin to compile the right module
<project>
(...)
<properties>
(...)
<!--
Suffix appended to the names of the GWT modules we compile in our child projects.
Empty by default, this suffix is overriden by some profiles to specify an alternative module to compile.
-->
<gwt.module.suffix></gwt.module.suffix>
<!-- We force GWT-recompilation by default (except when using the "gwtDebug" profile - see below for more info) -->
<gwt.compiler.force>true</gwt.compiler.force>
</properties>
(...)
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>gwt-maven-plugin</artifactId>
<configuration>
(...)
<module>com.example.MainModule${gwt.module.suffix}</module>
</configuration>
</plugin>
(...)
<profiles>
<!-- This profile should be used during *DEVELOPMENT* -->
<profile>
<id>gwtDebug</id>
<properties>
<gwt.module.suffix>Debug</gwt.module.suffix>
<!-- Tells gwt-maven-plugin to recompile GWT modules only when necessary -->
<gwt.compiler.force>false</gwt.compiler.force>
</properties>
<activation>
<property>
<name>gwtDebug</name>
</property>
</activation>
</profile>
</profiles>
</project>
Simply doing "maven clean install" will compile the production module. In development, you use "mvn clean install -DgwtDebug" to activate the gwtDebug profile, which in turn compiles the debug module.
Of course, you could configure your ~/.m2/settings.xml to always define the "gwtDebug" property...
The same idea would also apply to Ant. But I'm not well versed with it.
When you starts to toy with the idea of overriding your real module with a debug module, you start to envision some very cool possibilities:
You could add performance logs, which would be pruned from the code when in production.
You could configure all your toString() methods to return something useful when in debug mode, and the empty string when in production (and thus reduce the .js size).
You may reduce the number of permutations by specifying only one locale / one browser / one log level, to speed up the compilation (but do not forget to test for other locales / browsers from time to time).