Question

有谁知道如何抑制ESAPI库输出的以下噪音消息？

System property [org.owasp.esapi.opsteam] is not setAttempting to load ESAPI.properties via file I/O.
Attempting to load ESAPI.properties as resource file via file I/O.

System property [org.owasp.esapi.devteam] is not set
Not found in 'org.owasp.esapi.resources' directory or file not readable: C:\Users\ktamura\Desktop\embtest-master\ESAPI.properties
Not found in SystemResource Directory/resourceDirectory: .esapi\ESAPI.properties
Not found in 'user.home' (C:\Users\ktamura) directory: C:\Users\ktamura\esapi\ESAPI.properties
Loading ESAPI.properties via file I/O failed. Exception was: java.io.FileNotFoundException
Attempting to load ESAPI.properties via the classpath.
SUCCESSFULLY LOADED ESAPI.properties via the CLASSPATH from '/ (root)' using current thread context class loader!
SecurityConfiguration for Validator.ConfigurationFile.MultiValued not found in ESAPI.properties. Using default: false
Attempting to load validation.properties via file I/O.
Attempting to load validation.properties as resource file via file I/O.
Not found in 'org.owasp.esapi.resources' directory or file not readable: C:\Users\ktamura\Desktop\embtest-master\validation.properties
Not found in SystemResource Directory/resourceDirectory: .esapi\validation.properties
Not found in 'user.home' (C:\Users\ktamura) directory: C:\Users\ktamura\esapi\validation.properties
Loading validation.properties via file I/O failed.
Attempting to load validation.properties via the classpath.
validation.properties could not be loaded by any means. fail. Exception was: java.lang.IllegalArgumentException: Failed to load ESAPI.properties as a classloader resource.

我将库添加到我的Web应用程序（包括嵌入式Tomcat）和ESAPI验证工作，但输出了嘈杂的消息。

Java代码：

writer.write(ESAPI.encoder().encodeForHTML("<test>"));

ESAPI的依赖：

<dependency>
    <groupId>org.owasp.esapi</groupId>
    <artifactId>esapi</artifactId>
    <version>2.1.0.1</version>
</dependency>

ESAPI.properties ：

https://github.com/k-tamura/embtest/blob/master/src/main/resources/ESAPI.properties

重现的步骤：

（1）运行命令：

$ git clone https://github.com/k-tamura/embtest.git
$ cd embtest
$ mvn clean install

（2）访问http://localhost:8080/ping - ＆gt;上述日志显示在控制台上。

环境（我的本地计算机）：

$ mvn -version
Apache Maven 3.2.2 (45f7c06d68e745d05611f7fd14efb6594181933e; 2014-06-17T22:51:42+09:00)
Maven home: c:\apache-maven-3.2.2
Java version: 1.8.0_121, vendor: Oracle Corporation
Java home: c:\Program Files\Java\jdk1.8.0_121\jre
Default locale: ja_JP, platform encoding: MS932
OS name: "windows 7", version: "6.1", arch: "amd64", family: "dos"

Answer 1

我可以通过参考@ avgvstvs的答案解决此问题以添加InitializationListener：

import java.io.OutputStream;
import java.io.PrintStream;

import javax.servlet.ServletContextEvent;
import javax.servlet.ServletContextListener;
import javax.servlet.annotation.WebListener;

import org.owasp.esapi.ESAPI;

@WebListener
public class InitializationListener implements ServletContextListener {
    public void contextInitialized(ServletContextEvent event) {

        /* Suppress noisy messages output by the ESAPI library. */
        PrintStream original = System.out;
        try (PrintStream out = new PrintStream(new OutputStream() {
            @Override
            public void write(int b) {
                // Do nothing
            }
        })) {
            System.setOut(out);
            System.setErr(out);
            ESAPI.encoder();
        } catch (Exception e) {
            // Do nothing
        } finally {
            System.setOut(original);
        }
    }

    @Override
    public void contextDestroyed(ServletContextEvent sce) {
        // Do nothing
    }
}

Answer 2

你得到鸡蛋和鸡蛋的情景。这些陈述来自System.out.println()和System.err.println()的组合。

问题是我们需要加载属性文件以确定要加载的记录器，但是在初始化时......我们没有实例化记录器。

因此我们默认使用唯一的其他选项，即控制台输出。

过去我们删除了它，但邮件列表被＃34;我的应用程序无法启动，HEEEEELP！＆＃34;

所以他们又回来了，他们不会去任何地方：功能不是错误。

如果您决定摆脱文件搜索消息，我建议重定向输出流，就像它们here.

一样

OutputStream output = new FileOutputStream("/dev/null");
PrintStream printOut = new PrintStream(output);

System.setOut(printOut);

免责声明：我是ESAPI-java联合主管之一。

如何禁止ESAPI库输出的消息

2 个答案: