Kingdom: Encapsulation

Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not.

Poor Logging Practice: Multiple Loggers

Java/JSP

Abstract

Use logging levels rather than multiple loggers in a single class.

Explanation

Good logging practice dictates the use of a single logger for each class.

Example 1: The following code errantly declares multiple loggers.


public class MyClass {
  private final static Logger good =
            Logger.getLogger(MyClass.class);
  private final static Logger bad =
            Logger.getLogger(MyClass.class);
  private final static Logger ugly =
            Logger.getLogger(MyClass.class);
  ...
}

References

[1] Standards Mapping - Common Weakness Enumeration CWE ID 398

[2] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000154

[3] Standards Mapping - FIPS200 AU

[4] Standards Mapping - NIST Special Publication 800-53 Revision 4 AU-6 Audit Review and Analysis and Reporting (P1)

[5] Standards Mapping - NIST Special Publication 800-53 Revision 5 AU-6 Audit Record Review and Analysis and Reporting

[6] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001130 CAT II

[7] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-001130 CAT II

desc.structural.java.poor_logging_practice_multiple_loggers