title: security flaw - veracode report - crlf injection
body: <p>I got the veracode report for my javaEE app. It had a flaw at any logging (using log4j), so I add the <code>StringEscapeUtils.escapeJava(log)</code> to all of them, but veracode keeps reporting them as security flaws.</p>
  
  <p>Is this a right solution?
  What else can I do?</p>
  
  <p>This is the report info:
  Title:
  Improper Output Neutralization for Logs</p>
  
  <p>Description:
  A function call could result in a log forging attack. Writing unsanitized user-supplied data into a log file allows an
  attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an
  attacker's tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web
  administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible.</p>
  
  <p>Recommendations:
  Avoid directly embedding user input in log files when possible. Sanitize user-supplied data used to construct log
  entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove
  unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric
  data. Only write custom blacklisting code when absolutely necessary. Always validate user-supplied input to ensure
  that it conforms to the expected format, using centralized data validation routines when possible.</p>
  
  <p>They recommend to use ESAPI, but it is a very big project so I need the simplest solution, tht's why I tried with String.escape 'StringEscapeUtils.escapeJava(log)'</p>
  
  <p>Thx in advanced!</p>