A1 Injection issue reported by fortify tool

[Ash]

Hello,

Need help to resolve A1 Injection issue reported by fortify tool.

Detail below:

The method load() in SummaryAction.java writes unvalidated user input
to the log on line 71. An attacker could take advantage of this behavior to forge log
entries or inject malicious content into the log.

SummaryAction.java:71 org.apache.log4j.Category.info()
69 SummaryForm sForm = (SummaryForm) form;
70 logger.info("[SummaryAction]=tNo="+txInfo.getTNumber());
71 logger.info("[SummaryAction]=AppNo="+txInfo.getAppNumber());

load method snippet from SummaryAction.java:

private void load(ActionMapping mapping,
ActionForm form,
HttpServletRequest request,
HttpServletResponse response, boolean isLoad) throws SystemException, ApplicationException
{
AbstractTransactionInfo txInfo = getTransactionInfo(request);
SummaryForm sForm = (SummaryForm) form;
logger.info("[SummaryAction]=tNo="+tInfo.getTxNumber());
logger.info("[SummaryAction]=AppNo="+tInfo.getAppNumber());

Please provide suitable solution. Thanks in advance. :) 

[Nic Brough -Adaptavist- · Accepted solution]

An attacker would have to be at least a Jira admin in order to inject the code needed to do this, and if they are an admin, there are far worse things they could do.

The solution is "don't allow admin access to malicious users"