I am trying to test the output of the logs which have some patterns to exclude in my config file. In the logs I have replaced the javascript word with space character and i wanted to test this with assert statement.
Application.java
@SpringBootApplication
public class Application {
public static void main(String[] args) {
SpringApplication.run(Application.class, args);
}
}
ApplicationTest.java
import ch.qos.logback.classic.Level;
import ch.qos.logback.classic.Logger;
import ch.qos.logback.classic.LoggerContext;
import ch.qos.logback.classic.spi.ILoggingEvent;
import ch.qos.logback.core.read.ListAppender;
import com.testing.test.proj.util.MemoryAppender;
import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;
import org.slf4j.LoggerFactory;
import java.util.List;
import java.util.stream.Collectors;
import static org.assertj.core.api.Assertions.assertThat;
@Slf4j
public class ApplicationTest {
@Test
public void testLogging()
{
String[] args = {};
Application.main(args);
assertThat(args).isNotNull();
Logger logger = (Logger)LoggerFactory.getLogger(Logger.ROOT_LOGGER_NAME);
ListAppender<ILoggingEvent> listAppender = new ListAppender<>();
logger.addAppender(listAppender);
listAppender.start();
log.info("<html><h1>Testing escape character<h1>");
log.info("<body onload="javascript:alert(1)"/>");
log.info("</html>");
List<ILoggingEvent> logsList = listAppender.list;
System.out.println(logsList.stream()
.filter(event -> event.getMessage().contains("javascript") &&
event.getLevel().equals(ch.qos.logback.classic.Level.INFO))
.collect(Collectors.toList()));
assertThat(logsList.stream()
.filter(event -> event.getMessage().contains("javascript"))
.collect(Collectors.toList()).size()).isEqualTo(0);
}
}
In Application.yaml file I have one pattern to replace javascript with a space character.
application.yaml
logging:
pattern:
console: "%clr(%d{${LOG_DATEFORMAT_PATTERN:yyyy-MM-dd HH:mm:ss.SSS}}){faint} %clr(${LOG_LEVEL_PATTERN:%5p}) %clr(${PID}){magenta} %clr(---){faint} %clr([%15.15t]){faint} %clr(%-40.40logger{39}){cyan} %clr(:){faint} %replace(%m){'javascript:',''}%n${LOG_EXCEPTION_CONVERSION_WORD:%wEx}}"
But While printing the log from appender I can see it is not able to print the replaced logs instead it is printing the log what I have given in the code.
Output
2021-01-12 16:18:51.411 INFO [test,,,] 4068 --- [ main] c.s.cloud.test.proj.Application : Started Application in 34.547 seconds (JVM running for 36.526)
2021-01-12 16:18:51.536 INFO [test,,,] 4068 --- [ main] c.s.cloud.test.proj.ApplicationTest : <html><h1>Testing escape character<h1>
2021-01-12 16:18:51.536 INFO [test,,,] 4068 --- [ main] c.s.cloud.test.proj.ApplicationTest : <body onload="alert(1)"/>
2021-01-12 16:18:51.536 INFO [test,,,] 4068 --- [ main] c.s.cloud.test.proj.ApplicationTest : </html>
[[INFO] <body onload="javascript:alert(1)"/>]
org.opentest4j.AssertionFailedError:
Expecting:
<1>
to be equal to:
<0>
but was not.
Expected :0
Actual :1
<Click to see difference>
If You can see the system.out.println() output then you can find it has javascript in the log.
I want the solution where I can test the log which are actually getting printed on the screen not what I have given in the log.info.
与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…
