S5145 possible false positive with log4j2

[lpouget (Laurent Pouget)]

Hi,

We are using log4j2 and we were hitting the S5145 security rule.

We mitigate it by using the pattern %enc{}{CRLF} in our logging configuration but sonar doesn’t seems to see it.

Did we hit a sonar limitation or our solution doesn’t really mitigate the issue ?

[Colin]

Hey @lpouget

Please read this thread regarding reporting false-positives:

How to Report a False-positive / False-negative

Hey SonarSource Community! False-positives happen, as do false-negatives, and we’re eager to fix them. We are thrilled when our users report problems, so we can make our products better. What is a false-positive (FP)? A false-positive is when an issue is raised unexpectedly on code that should not trigger an issue, or where the suggested action doesn’t make any sense for the code. What is a false-negative (FN)? A false-negative is when an issue should be raised on a piece of code, but isn’t…