如何抑制 ESAPI 库输出的消息

Question

有谁知道如何抑制 ESAPI 库输出的以下嘈杂消息？

System property [org.owasp.esapi.opsteam] is not setAttempting to load ESAPI.properties via file I/O.
Attempting to load ESAPI.properties as resource file via file I/O.

System property [org.owasp.esapi.devteam] is not set
Not found in 'org.owasp.esapi.resources' directory or file not readable: C:\Users\ktamura\Desktop\embtest-master\ESAPI.properties
Not found in SystemResource Directory/resourceDirectory: .esapi\ESAPI.properties
Not found in 'user.home' (C:\Users\ktamura) directory: C:\Users\ktamura\esapi\ESAPI.properties
Loading ESAPI.properties via file I/O failed. Exception was: java.io.FileNotFoundException
Attempting to load ESAPI.properties via the classpath.
SUCCESSFULLY LOADED ESAPI.properties via the CLASSPATH from '/ (root)' using current thread context class loader!
SecurityConfiguration for Validator.ConfigurationFile.MultiValued not found in ESAPI.properties. Using default: false
Attempting to load validation.properties via file I/O.
Attempting to load validation.properties as resource file via file I/O.
Not found in 'org.owasp.esapi.resources' directory or file not readable: C:\Users\ktamura\Desktop\embtest-master\validation.properties
Not found in SystemResource Directory/resourceDirectory: .esapi\validation.properties
Not found in 'user.home' (C:\Users\ktamura) directory: C:\Users\ktamura\esapi\validation.properties
Loading validation.properties via file I/O failed.
Attempting to load validation.properties via the classpath.
validation.properties could not be loaded by any means. fail. Exception was: java.lang.IllegalArgumentException: Failed to load ESAPI.properties as a classloader resource.

我将该库添加到我的 Web 应用程序（包括嵌入式 Tomcat）并且 ESAPI 验证有效，但输出了嘈杂的消息。

Java 代码：

writer.write(ESAPI.encoder().encodeForHTML("<test>"));

ESAPI的依赖：

<dependency>
    <groupId>org.owasp.esapi</groupId>
    <artifactId>esapi</artifactId>
    <version>2.1.0.1</version>
</dependency>

ESAPI.properties：

https://github.com/k-tamura/embtest/blob/master/src/main/resources/ESAPI.properties

重现步骤：

(1) 运行命令：

$ git clone https://github.com/k-tamura/embtest.git
$ cd embtest
$ mvn clean install

(2) 访问http://localhost:8080/ping -> 以上日志显示在控制台上。

环境（我的本地机器）：

$ mvn -version
Apache Maven 3.2.2 (45f7c06d68e745d05611f7fd14efb6594181933e; 2014-06-17T22:51:42+09:00)
Maven home: c:\apache-maven-3.2.2
Java version: 1.8.0_121, vendor: Oracle Corporation
Java home: c:\Program Files\Java\jdk1.8.0_121\jre
Default locale: ja_JP, platform encoding: MS932
OS name: "windows 7", version: "6.1", arch: "amd64", family: "dos"

Answer 1

我可以通过参考@avgvstvs 的回答来解决此问题以添加InitializationListener：

import java.io.OutputStream;
import java.io.PrintStream;

import javax.servlet.ServletContextEvent;
import javax.servlet.ServletContextListener;
import javax.servlet.annotation.WebListener;

import org.owasp.esapi.ESAPI;

@WebListener
public class InitializationListener implements ServletContextListener {
    public void contextInitialized(ServletContextEvent event) {

        /* Suppress noisy messages output by the ESAPI library. */
        PrintStream original = System.out;
        try (PrintStream out = new PrintStream(new OutputStream() {
            @Override
            public void write(int b) {
                // Do nothing
            }
        })) {
            System.setOut(out);
            System.setErr(out);
            ESAPI.encoder();
        } catch (Exception e) {
            // Do nothing
        } finally {
            System.setOut(original);
        }
    }

    @Override
    public void contextDestroyed(ServletContextEvent sce) {
        // Do nothing
    }
}

Answer 2

你被一个先有鸡还是先有蛋的场景所困扰。这些声明来自System.out.println() 和System.err.println() 的组合。

问题是我们需要加载属性文件以确定要加载的记录器，但是在初始化时……我们没有实例化记录器。

所以我们默认使用唯一的其他选项，即控制台输出。

过去我们已将其删除，但随后邮件列表被“我的应用程序无法启动，HEEEEELP！”所淹没

所以他们回来了，他们不会去任何地方：功能不是错误。

如果您决心摆脱文件搜索消息，我建议像 here. 那样重定向输出流

OutputStream output = new FileOutputStream("/dev/null");
PrintStream printOut = new PrintStream(output);

System.setOut(printOut);

免责声明：我是 ESAPI-java 的联合负责人之一。