-
madhavi.dintakurthy authored
The new -j flag for varnishncsa allows writing JSON logs in combination with -f or -F to specify a custom format. Without -j, the format specifiers could be replaced with strings that would make the JSON invalid. One example is headers: without -j, some headers may be replaced with C-style \xXX escape sequences, which are not valid JSON. Since request headers are controlled by users on the internet, it would be easy for an attacker to make a log entry impossible to parse, which might cause it to be missed by administrators. Another example is numbers. Without -j, format specifiers are replaced with - if the value is empty. A bare - is not valid in JSON, so numbers are replaced with null with the -j flag. In general, -j makes the replacements JSON-compatible for all inputs. Co-authored-by: Ben Zvan <ben.zvan@target.com> Co-authored-by: Jasmine Wang <jasmine.wang@target.com> Co-authored-by: Jordan Christiansen <jordan.christiansen@target.com> Co-authored-by: Madhavi Dintakurthy <madhavi.dintakurthy@target.com>
300ede26