1

Recently, the log4j issue got a lot of attention. I run a chatbot web app that is not based on the JAVA stack. However, there is a backend component that analyzes the chatbot user input which is based on JAVA. I wonder to mitigate the log4j issue, whether scanning the text input as a pre-processing in the backend and removing all the references of ${jndi: is a solution to mitigate the security issue?

Anders
  • 64,406
  • 24
  • 178
  • 215
Iching Chang
  • 111
  • 2
  • Isn't this question just a more specific case of [Can one protect from the Log4j exp by sanitizing the parameters](/q/257921/129883)? – Fire Quacker Dec 23 '21 at 13:50
  • There are too much ways the attack string can look like and the simple string match will only match the simple ones. – Steffen Ullrich Dec 23 '21 at 14:40

0 Answers0