From: Hal Brodigan Date: 2011-01-16T20:56:43+09:00 Subject: [ruby-core:34519] [Ruby 1.9-Bug#3869] Logger#log does not handle or escape new-line characters. --mimepart_4d32dcfbae455_1dc2b3c90fa8281 Content-Type: text/plain Content-Transfer-Encoding: Quoted-printable Content-Disposition: inline Issue #3869 has been updated by Hal Brodigan. File logger.rb.patch added This is a delightful increase in bug-tracker activity. :) NaHi-san, I was unaware that Logger was designed for Diagnostic logging. = I recently used Logger in some backend Ruby scripts to collect status/per= formance-metrics. Obviously, I was tempted to watch the `tail` of these l= ogs. I will switch to using Syslog, instead of Logger. I agree that escaping the entire log message is a bit heavy handed. Perha= ps it would be possible to allow the log message to be given as an Array,= where the first argument is a format String and the additional arguments= are the potentially dangerous data to format. `Formatter#msg2str` could = be modified to allow this new convention. This solution would still rely on the developer being aware of when poten= tially dangerous input is passed to Logger, and use the %p formatting opt= ion as a protection: logger.info ["User input received: %p", input] ---------------------------------------- http://redmine.ruby-lang.org/issues/show/3869 ---------------------------------------- http://redmine.ruby-lang.org --mimepart_4d32dcfbae455_1dc2b3c90fa8281 Content-Type: application/octet-stream; name=logger.rb.patch Content-Transfer-Encoding: Base64 Content-Disposition: attachment; filename=logger.rb.patch LS0tIGxvZ2dlci5yYi5vcmlnCTIwMTEtMDEtMTYgMDM6MzM6NDAuNDY0Mjg4 MDAyIC0wODAwCisrKyBsb2dnZXIucmIJMjAxMS0wMS0xNiAwMzo1OTowMS4y NDUyODgwMDIgLTA4MDAKQEAgLTEyNCwxMSArMTI0LDE1IEBACiAjCiAjICAg ICAgbG9nZ2VyLmVycm9yICJBcmd1bWVudCAjeyBAZm9vIH0gbWlzbWF0Y2gu IgogIwotIyAzLiBXaXRoIHByb2duYW1lLgorIyAzLiBNZXNzYWdlIGFzIGEg Zm9ybWF0IHN0cmluZy4KKyMKKyMgICAgICBsb2dnZXIuZGVidWcgWyJVc2Vy LWlucHV0OiAlcCIsIGlucHV0XQorIworIyA0LiBXaXRoIHByb2duYW1lLgog IwogIyAgICAgIGxvZ2dlci5pbmZvKCdpbml0aWFsaXplJykgeyAiSW5pdGlh bGl6aW5nLi4uIiB9CiAjCi0jIDQuIFdpdGggc2V2ZXJpdHkuCisjIDUuIFdp dGggc2V2ZXJpdHkuCiAjCiAjICAgICAgbG9nZ2VyLmFkZChMb2dnZXI6OkZB VEFMKSB7ICdGYXRhbCBlcnJvciEnIH0KICMKQEAgLTM3NCw2ICszNzgsOSBA QAogICAjICAgbG9nZ2VyLmluZm8gIldhaXRpbmcgZm9yIGlucHV0IGZyb20g dXNlciIKICAgIyAgICMgLi4uCiAgICMgICBsb2dnZXIuaW5mbyB7ICJVc2Vy IHR5cGVkICN7aW5wdXR9IiB9CisgICMgICAjIC4uLgorICAjICAgbG9nZ2Vy LmluZm8gWyJVc2VyIGlucHV0OiAlcCIsIGlucHV0XQorICAjICAgIyAuLi4K ICAgIwogICAjIFlvdSdsbCBwcm9iYWJseSBzdGljayB0byB0aGUgc2Vjb25k IGZvcm0gYWJvdmUsIHVubGVzcyB5b3Ugd2FudCB0byBwcm92aWRlIGEKICAg IyBwcm9ncmFtIG5hbWUgKHdoaWNoIHlvdSBjYW4gZG8gd2l0aCA8dHQ+TG9n Z2VyI3Byb2duYW1lPTwvdHQ+IGFzIHdlbGwpLgpAQCAtNDcyLDYgKzQ3OSw4 IEBACiAgICAgICBjYXNlIG1zZwogICAgICAgd2hlbiA6OlN0cmluZwogICAg ICAgICBtc2cKKyAgICAgIHdoZW4gOjpBcnJheQorICAgICAgICBtc2dbMF0g JSBtc2dbMS4uLTFdCiAgICAgICB3aGVuIDo6RXhjZXB0aW9uCiAgICAgICAg ICIjeyBtc2cubWVzc2FnZSB9ICgjeyBtc2cuY2xhc3MgfSlcbiIgPDwKICAg ICAgICAgICAobXNnLmJhY2t0cmFjZSB8fCBbXSkuam9pbigiXG4iKQo= --mimepart_4d32dcfbae455_1dc2b3c90fa8281--