Package com.fayupable.logged.spring.support

Class LogSafe

java.lang.Object
com.fayupable.logged.spring.support.LogSafe
public final class LogSafe extends Object
Keeps a value that may come from outside the application (a username, an X-Forwarded-For entry, a custom resolver's result) on a single line when it is written into plain-text log output or the MDC.

Without this, a value containing a line break could forge an extra, genuine-looking log line (log injection). Control characters are replaced by visible escapes (a backslash followed by n, r, t, or u and four hex digits), in the same style JsonInvocationEventEmitter uses, rather than removed, so an injection attempt stays visible in the log. Escaped are C0 controls and DEL, C1 controls (including NEL, U+0085) and the Unicode line and paragraph separators (U+2028, U+2029), which some log viewers also treat as line breaks. Everything else, including non-ASCII letters, is kept as is.

The common case costs a single scan: a value with nothing to escape is returned as the same instance, without copying.

This class is used internally by this library's emitters and MDC propagation. It is public only because those live in different packages; it is not part of the supported API and may change without notice.

  • Method Details

    • singleLine

      public static String singleLine(String value)
      Returns value with every line-breaking or invisible control character replaced by a visible escape.
      Parameters:
      value - the value to make safe, may be null
      Returns:
      value itself when nothing needs escaping, an escaped copy otherwise, or null for null