2:14 p.m.
hello undertow developers!
we are trying to disable logging of io exceptions like the comment in UndertowLogger.java
suggests:
/**
* Logger used for IO exceptions. Generally these should be suppressed, because they
are of little interest, and it is easy for an
* attacker to fill up the logs by intentionally causing IO exceptions.
*/
UndertowLogger REQUEST_IO_LOGGER = Logger.getMessageLogger(UndertowLogger.class,
UndertowLogger.class.getPackage().getName() + ".request.io");
so we disable io.undertow.request.io
but it seems that there are still io exceptions logged as io.undertow.request, i see log
entries like this:
io.undertow.request 2017-06-08 23:44:14,898 UT005003: IOException reading from channel
java.io.IOException: UT000128: Remote peer closed connection before all data could be
read
at
io.undertow.conduits.FixedLengthStreamSourceConduit.exitRead(FixedLengthStreamSourceConduit.java:338)
at
io.undertow.conduits.FixedLengthStreamSourceConduit.read(FixedLengthStreamSourceConduit.java:255)
at
org.xnio.conduits.ConduitStreamSourceChannel.read(ConduitStreamSourceChannel.java:127)
at
io.undertow.channels.DetachableStreamSourceChannel.read(DetachableStreamSourceChannel.java:209)
at
io.undertow.server.HttpServerExchange$ReadDispatchChannel.read(HttpServerExchange.java:2287)
at
io.undertow.server.handlers.form.FormEncodedDataDefinition$FormEncodedDataParser.doParse(FormEncodedDataDefinition.java:134)
at
io.undertow.server.handlers.form.FormEncodedDataDefinition$FormEncodedDataParser.handleEvent(FormEncodedDataDefinition.java:115
to me it seems that the handler for form encoded post data uses the wrong logger for its
io exceptions.
best, sascha
2:21 a.m.
If you file a JIRA I will fix this.
Stuart
On Fri, Jun 9, 2017 at 2:14 PM, Sascha Sadat-Guscheh <kid(a)bitkid.com> wrote:
hello undertow developers!
we are trying to disable logging of io exceptions like the comment in
UndertowLogger.java suggests:
/**
* Logger used for IO exceptions. Generally these should be suppressed,
because they are of little interest, and it is easy for an
* attacker to fill up the logs by intentionally causing IO exceptions.
*/
UndertowLogger REQUEST_IO_LOGGER =
Logger.getMessageLogger(UndertowLogger.class,
UndertowLogger.class.getPackage().getName() + ".request.io");
so we disable io.undertow.request.io
but it seems that there are still io exceptions logged as
io.undertow.request, i see log entries like this:
io.undertow.request 2017-06-08 23:44:14,898 UT005003: IOException reading
from channel java.io.IOException: UT000128: Remote peer closed connection
before all data could be read
at
io.undertow.conduits.FixedLengthStreamSourceConduit.exitRead(FixedLengthStreamSourceConduit.java:338)
at
io.undertow.conduits.FixedLengthStreamSourceConduit.read(FixedLengthStreamSourceConduit.java:255)
at
org.xnio.conduits.ConduitStreamSourceChannel.read(ConduitStreamSourceChannel.java:127)
at
io.undertow.channels.DetachableStreamSourceChannel.read(DetachableStreamSourceChannel.java:209)
at
io.undertow.server.HttpServerExchange$ReadDispatchChannel.read(HttpServerExchange.java:2287)
at
io.undertow.server.handlers.form.FormEncodedDataDefinition$FormEncodedDataParser.doParse(FormEncodedDataDefinition.java:134)
at
io.undertow.server.handlers.form.FormEncodedDataDefinition$FormEncodedDataParser.handleEvent(FormEncodedDataDefinition.java:115
to me it seems that the handler for form encoded post data uses the wrong
logger for its io exceptions.
best, sascha
_______________________________________________
undertow-dev mailing list
undertow-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/undertow-dev
9:10 a.m.
I’m a coworker of sascha’s and i filed a pr (#525) for this
-chris
On 14 Jun 2017, at 02:21, Stuart Douglas <sdouglas(a)redhat.com>
wrote:
If you file a JIRA I will fix this.
Stuart
On Fri, Jun 9, 2017 at 2:14 PM, Sascha Sadat-Guscheh <kid(a)bitkid.com> wrote:
> hello undertow developers!
>
> we are trying to disable logging of io exceptions like the comment in
> UndertowLogger.java suggests:
>
> /**
> * Logger used for IO exceptions. Generally these should be suppressed,
> because they are of little interest, and it is easy for an
> * attacker to fill up the logs by intentionally causing IO exceptions.
> */
> UndertowLogger REQUEST_IO_LOGGER =
> Logger.getMessageLogger(UndertowLogger.class,
> UndertowLogger.class.getPackage().getName() + ".request.io");
>
> so we disable io.undertow.request.io
>
> but it seems that there are still io exceptions logged as
> io.undertow.request, i see log entries like this:
> io.undertow.request 2017-06-08 23:44:14,898 UT005003: IOException reading
> from channel java.io.IOException: UT000128: Remote peer closed connection
> before all data could be read
> at
>
io.undertow.conduits.FixedLengthStreamSourceConduit.exitRead(FixedLengthStreamSourceConduit.java:338)
> at
>
io.undertow.conduits.FixedLengthStreamSourceConduit.read(FixedLengthStreamSourceConduit.java:255)
> at
>
org.xnio.conduits.ConduitStreamSourceChannel.read(ConduitStreamSourceChannel.java:127)
> at
>
io.undertow.channels.DetachableStreamSourceChannel.read(DetachableStreamSourceChannel.java:209)
> at
>
io.undertow.server.HttpServerExchange$ReadDispatchChannel.read(HttpServerExchange.java:2287)
> at
>
io.undertow.server.handlers.form.FormEncodedDataDefinition$FormEncodedDataParser.doParse(FormEncodedDataDefinition.java:134)
> at
>
io.undertow.server.handlers.form.FormEncodedDataDefinition$FormEncodedDataParser.handleEvent(FormEncodedDataDefinition.java:115
>
> to me it seems that the handler for form encoded post data uses the wrong
> logger for its io exceptions.
>
> best, sascha
>
> _______________________________________________
> undertow-dev mailing list
> undertow-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/undertow-dev
_______________________________________________
undertow-dev mailing list
undertow-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/undertow-dev
2514
days inactive
2519
days old
2 comments
3 participants
participants (3)
-
Christoph Sturm -
Sascha Sadat-Guscheh -
Stuart Douglas