Changing Logging Level of OWasp CSRFGuard - csrf

Question

I have successfully installed OWasp CSRFGuard in my Java Application.
My CSRFGuard.Properties file contains the following:
# Logger
#
# The logger property (org.owasp.csrfguard.Logger) defines the qualified class name of
# the object responsible for processing all log messages produced by CSRFGuard. The default
# CSRFGuard logger is org.owasp.csrfguard.log.ConsoleLogger. This class logs all messages
# to System.out which JavaEE application servers redirect to a vendor specific log file.
# Developers can customize the logging behavior of CSRFGuard by implementing the
# org.owasp.csrfguard.log.ILogger interface and setting the logger property to the new
# logger's qualified class name. The following configuration snippet instructs OWASP CSRFGuard
# to capture all log messages to the console:
#
# org.owasp.csrfguard.Logger=org.owasp.csrfguard.log.ConsoleLogger
org.owasp.csrfguard.Logger=org.owasp.csrfguard.log.JavaLogger
I can see the different logging levels from https://www.javatips.net/api/OWASP-CSRFGuard-master/csrfguard/src/main/java/org/owasp/csrfguard/log/JavaLogger.java
LOGGER.log(Level.FINEST, exception.getLocalizedMessage(), exception);
break;
case Debug:
LOGGER.log(Level.FINE, exception.getLocalizedMessage(), exception);
break;
case Info:
LOGGER.log(Level.INFO, exception.getLocalizedMessage(), exception);
break;
case Warning:
LOGGER.log(Level.WARNING, exception.getLocalizedMessage(), exception);
break;
case Error:
LOGGER.log(Level.WARNING, exception.getLocalizedMessage(), exception);
break;
case Fatal:
LOGGER.log(Level.SEVERE
How can I change the logging level in CSRFGuard.Properties to show only Level.WARNING
At the moment, every request is analyzed and logged.
INFO: CsrfGuard analyzing request example.com/examplepage.jsp

Answer 1

Replace the following line in CSRFGuard.Properties
org.owasp.csrfguard.Logger=org.owasp.csrfguard.log.JavaLogger
with
org.owasp.csrfguard.Logger=com.myPackage.MyLogger
And add a new class as below (based on this code), setting your required log level in the MyLogger() constructor (in the example below I set the minimum log level to Level.WARNING)
package com.myPackage
import java.util.logging.Level;
import java.util.logging.Logger;
import org.owasp.csrfguard.log.LogLevel;
public class MyLogger implements org.owasp.csrfguard.log.ILogger {
private static final long serialVersionUID = 1L;
private final static Logger LOGGER = Logger.getLogger("Owasp.CsrfGuard");
public MyLogger() {
LOGGER.setLevel(Level.WARNING);
}
#Override
public void log(String msg) {
LOGGER.info(msg.replaceAll("(\\r|\\n)", ""));
}
#Override
public void log(LogLevel level, String msg) {
// Remove CR and LF characters to prevent CRLF injection
String sanitizedMsg = msg.replaceAll("(\\r|\\n)", "");
switch(level) {
case Trace:
LOGGER.finest(sanitizedMsg);
break;
case Debug:
LOGGER.fine(sanitizedMsg);
break;
case Info:
LOGGER.info(sanitizedMsg);
break;
case Warning:
LOGGER.warning(sanitizedMsg);
break;
case Error:
LOGGER.warning(sanitizedMsg);
break;
case Fatal:
LOGGER.severe(sanitizedMsg);
break;
default:
throw new RuntimeException("unsupported log level " + level);
}
}
#Override
public void log(Exception exception) {
LOGGER.log(Level.WARNING, exception.getLocalizedMessage(), exception);
}
#Override
public void log(LogLevel level, Exception exception) {
switch(level) {
case Trace:
LOGGER.log(Level.FINEST, exception.getLocalizedMessage(), exception);
break;
case Debug:
LOGGER.log(Level.FINE, exception.getLocalizedMessage(), exception);
break;
case Info:
LOGGER.log(Level.INFO, exception.getLocalizedMessage(), exception);
break;
case Warning:
LOGGER.log(Level.WARNING, exception.getLocalizedMessage(), exception);
break;
case Error:
LOGGER.log(Level.WARNING, exception.getLocalizedMessage(), exception);
break;
case Fatal:
LOGGER.log(Level.SEVERE, exception.getLocalizedMessage(), exception);
break;
default:
throw new RuntimeException("unsupported log level " + level);
}
}
}