Pass Veracode CWE 117 (Improper Output Neutralization for Logs) only with replaceAll(“\r”, “_”).replaceAll(“\n”, “_”)
问题 I read on some forums the myth that it is enough to pass the Veracode CWE 117 (Improper Output Neutralization for Logs) issue by doing something like this. Can somebody confirm if this is the case or not ? message.replaceAll("\r", "_").replaceAll("\n", "_"); From this topic How to fix Veracode CWE 117 (Improper Output Neutralization for Logs) , I understand that I need to do something like this ESAPI.encoder().encodeForHTML(message); 回答1: The message needs to be escaped for the context which