How to fix Veracode CWE 117 (Improper Output Neutralization for Logs)

Question

There is an Spring global @ExceptionHandler(Exception.class) method which logs exception like that:

@ExceptionHandler(Exception.class)
void handleEx         


        

Answer 1

If you are using Logback use the replace function in your logback config pattern

original pattern

%d %level %logger : %msg%n

with replace

%d %level %logger : %replace(%msg){'[\r\n]', '_'} %n

if you want to strip