Introduction to Log Masking

Log masking is a critical security practice that prevents sensitive information from being exposed in application logs. This comprehensive guide covers techniques, patterns, and best practices for implementing effective log masking in Java applications.

Core Masking Strategies

1. Pattern-Based Masking

2. Annotation-Driven Masking

3. Custom Masking Providers

4. Log Framework Integrations

Basic Pattern-Based Masking

Simple Regex Masking Utility

import java.util.regex.*; import java.util.*; public class BasicLogMasker { private static final Map<Pattern, String> MASK_PATTERNS = new LinkedHashMap<>(); static { // Credit card patterns MASK_PATTERNS.put(Pattern.compile("\\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})\\b"), "****-****-****-####"); MASK_PATTERNS.put(Pattern.compile("\\b3[47][0-9]{13}\\b"), "****-******-####"); // SSN patterns MASK_PATTERNS.put(Pattern.compile("\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b"), "***-**-####"); // Email patterns MASK_PATTERNS.put(Pattern.compile("\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Z|a-z]{2,}\\b"), "***@***.***"); // Phone numbers MASK_PATTERNS.put(Pattern.compile("\\b\\(?[0-9]{3}\\)?[-. ]?[0-9]{3}[-. ]?[0-9]{4}\\b"), "(***) ***-####"); // API keys (common patterns) MASK_PATTERNS.put(Pattern.compile("\\bsk_[a-zA-Z0-9]{20,}\\b"), "sk_************"); MASK_PATTERNS.put(Pattern.compile("\\bAKIA[0-9A-Z]{16}\\b"), "AKIA************"); } public static String maskSensitiveData(String input) { if (input == null || input.trim().isEmpty()) { return input; } String masked = input; for (Map.Entry<Pattern, String> entry : MASK_PATTERNS.entrySet()) { Pattern pattern = entry.getKey(); String replacement = entry.getValue(); Matcher matcher = pattern.matcher(masked); masked = matcher.replaceAll(replacement); } return masked; } // Specific masking methods for common data types public static String maskCreditCard(String creditCard) { if (creditCard == null || creditCard.length() < 12) { return creditCard; } return "****-****-****-" + creditCard.substring(creditCard.length() - 4); } public static String maskSSN(String ssn) { if (ssn == null || ssn.length() < 9) { return ssn; } return "***-**-" + ssn.substring(ssn.length() - 4); } public static String maskEmail(String email) { if (email == null || !email.contains("@")) { return email; } int atIndex = email.indexOf("@"); String localPart = email.substring(0, atIndex); String domain = email.substring(atIndex + 1); String maskedLocal = localPart.length() <= 2 ? "*".repeat(localPart.length()) : localPart.charAt(0) + "*".repeat(localPart.length() - 2) + localPart.charAt(localPart.length() - 1); int dotIndex = domain.lastIndexOf("."); String domainName = domain.substring(0, dotIndex); String tld = domain.substring(dotIndex + 1); String maskedDomain = domainName.length() <= 2 ? "*".repeat(domainName.length()) : domainName.charAt(0) + "*".repeat(domainName.length() - 2) + domainName.charAt(domainName.length() - 1); return maskedLocal + "@" + maskedDomain + "." + tld; } public static void main(String[] args) { // Test the masker String testData = "User with SSN 123-45-6789, email [email protected], " + "and credit card 4111-1111-1111-1111 called phone 555-123-4567."; System.out.println("Original: " + testData); System.out.println("Masked: " + maskSensitiveData(testData)); // Test individual methods System.out.println("\nIndividual masking:"); System.out.println("Credit Card: " + maskCreditCard("4111111111111111")); System.out.println("SSN: " + maskSSN("123456789")); System.out.println("Email: " + maskEmail("[email protected]")); } }

Advanced Annotation-Based Masking

Custom Annotations for Sensitive Data

import java.lang.annotation.*; import java.lang.reflect.*; import java.util.*; // Marker annotation for sensitive fields @Retention(RetentionPolicy.RUNTIME) @Target(ElementType.FIELD) public @interface SensitiveData { MaskType type() default MaskType.GENERIC; int visiblePrefix() default 0; int visibleSuffix() default 0; } // Masking strategies enum MaskType { CREDIT_CARD, SSN, EMAIL, PHONE, API_KEY, PASSWORD, GENERIC } // Sample entity class with sensitive data class User { private String username; @SensitiveData(type = MaskType.EMAIL) private String email; @SensitiveData(type = MaskType.SSN, visibleSuffix = 4) private String socialSecurityNumber; @SensitiveData(type = MaskType.CREDIT_CARD, visibleSuffix = 4) private String creditCardNumber; @SensitiveData(type = MaskType.PASSWORD) private String password; @SensitiveData(type = MaskType.PHONE, visiblePrefix = 3, visibleSuffix = 2) private String phoneNumber; // Constructors, getters, and setters public User(String username, String email, String ssn, String creditCard, String password, String phone) { this.username = username; this.email = email; this.socialSecurityNumber = ssn; this.creditCardNumber = creditCard; this.password = password; this.phoneNumber = phone; } // Getters and setters public String getUsername() { return username; } public String getEmail() { return email; } public String getSocialSecurityNumber() { return socialSecurityNumber; } public String getCreditCardNumber() { return creditCardNumber; } public String getPassword() { return password; } public String getPhoneNumber() { return phoneNumber; } } // Reflection-based masking utility public class AnnotationBasedMasker { public static String maskObject(Object obj) { if (obj == null) { return "null"; } StringBuilder result = new StringBuilder(); result.append(obj.getClass().getSimpleName()).append("{"); Field[] fields = obj.getClass().getDeclaredFields(); boolean firstField = true; for (Field field : fields) { if (!firstField) { result.append(", "); } firstField = false; field.setAccessible(true); result.append(field.getName()).append("="); try { Object value = field.get(obj); if (field.isAnnotationPresent(SensitiveData.class)) { SensitiveData annotation = field.getAnnotation(SensitiveData.class); String maskedValue = maskValue(value != null ? value.toString() : null, annotation); result.append(maskedValue); } else { result.append(value); } } catch (IllegalAccessException e) { result.append("[ACCESS_ERROR]"); } } result.append("}"); return result.toString(); } private static String maskValue(String value, SensitiveData annotation) { if (value == null) { return "null"; } switch (annotation.type()) { case CREDIT_CARD: return maskCreditCard(value, annotation.visibleSuffix()); case SSN: return maskSSN(value, annotation.visibleSuffix()); case EMAIL: return maskEmail(value); case PHONE: return maskPhone(value, annotation.visiblePrefix(), annotation.visibleSuffix()); case PASSWORD: return "********"; case API_KEY: return maskApiKey(value); case GENERIC: default: return maskGeneric(value, annotation.visiblePrefix(), annotation.visibleSuffix()); } } private static String maskCreditCard(String cardNumber, int visibleSuffix) { if (cardNumber.length() < visibleSuffix) { return "*".repeat(cardNumber.length()); } return "*".repeat(cardNumber.length() - visibleSuffix) + cardNumber.substring(cardNumber.length() - visibleSuffix); } private static String maskSSN(String ssn, int visibleSuffix) { if (ssn.length() < visibleSuffix) { return "*".repeat(ssn.length()); } return "*".repeat(ssn.length() - visibleSuffix) + ssn.substring(ssn.length() - visibleSuffix); } private static String maskEmail(String email) { if (!email.contains("@")) { return "*".repeat(email.length()); } String[] parts = email.split("@"); String localPart = parts[0]; String domain = parts[1]; String maskedLocal = localPart.length() <= 2 ? "*".repeat(localPart.length()) : localPart.charAt(0) + "*".repeat(Math.max(0, localPart.length() - 2)) + (localPart.length() > 1 ? localPart.charAt(localPart.length() - 1) : ""); return maskedLocal + "@" + maskDomain(domain); } private static String maskDomain(String domain) { if (!domain.contains(".")) { return "*".repeat(domain.length()); } int lastDot = domain.lastIndexOf("."); String domainName = domain.substring(0, lastDot); String tld = domain.substring(lastDot + 1); String maskedDomain = domainName.length() <= 2 ? "*".repeat(domainName.length()) : domainName.charAt(0) + "*".repeat(Math.max(0, domainName.length() - 2)) + (domainName.length() > 1 ? domainName.charAt(domainName.length() - 1) : ""); return maskedDomain + "." + tld; } private static String maskPhone(String phone, int visiblePrefix, int visibleSuffix) { // Remove non-digit characters for masking String digits = phone.replaceAll("\\D", ""); if (digits.length() < visiblePrefix + visibleSuffix) { return "*".repeat(phone.length()); } String prefix = digits.substring(0, visiblePrefix); String suffix = digits.substring(digits.length() - visibleSuffix); String middle = "*".repeat(digits.length() - visiblePrefix - visibleSuffix); return prefix + middle + suffix; } private static String maskApiKey(String apiKey) { if (apiKey.length() <= 8) { return "*".repeat(apiKey.length()); } return apiKey.substring(0, 4) + "*".repeat(apiKey.length() - 8) + apiKey.substring(apiKey.length() - 4); } private static String maskGeneric(String value, int visiblePrefix, int visibleSuffix) { if (value.length() < visiblePrefix + visibleSuffix) { return "*".repeat(value.length()); } String prefix = value.substring(0, Math.min(visiblePrefix, value.length())); String suffix = visibleSuffix > 0 ? value.substring(value.length() - Math.min(visibleSuffix, value.length())) : ""; String middle = "*".repeat(Math.max(0, value.length() - visiblePrefix - visibleSuffix)); return prefix + middle + suffix; } public static void main(String[] args) { User user = new User( "johndoe", "[email protected]", "123-45-6789", "4111-1111-1111-1111", "secret123", "+1-555-123-4567" ); System.out.println("Original user: " + user); System.out.println("Masked user: " + maskObject(user)); } }

Logback Configuration with Masking

Custom Logback Layout with Masking

<!-- logback.xml --> <configuration> <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender"> <encoder class="ch.qos.logback.core.encoder.LayoutWrappingEncoder"> <layout class="com.example.MaskingPatternLayout"> <pattern>%d{yyyy-MM-dd HH:mm:ss} [%thread] %-5level %logger{36} - %msg%n</pattern> </layout> </encoder> </appender> <appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender"> <file>logs/application.log</file> <encoder class="ch.qos.logback.core.encoder.LayoutWrappingEncoder"> <layout class="com.example.MaskingPatternLayout"> <pattern>%d{yyyy-MM-dd HH:mm:ss} [%thread] %-5level %logger{36} - %msg%n</pattern> </layout> </encoder> <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy"> <fileNamePattern>logs/application.%d{yyyy-MM-dd}.log</fileNamePattern> <maxHistory>30</maxHistory> </rollingPolicy> </appender> <root level="INFO"> <appender-ref ref="CONSOLE" /> <appender-ref ref="FILE" /> </root> </configuration>

import ch.qos.logback.classic.PatternLayout; import ch.qos.logback.classic.spi.ILoggingEvent; import java.util.regex.Pattern; import java.util.regex.Matcher; public class MaskingPatternLayout extends PatternLayout { private static final Pattern[] MASK_PATTERNS = { Pattern.compile("\\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})\\b"), // Credit cards Pattern.compile("\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b"), // SSN Pattern.compile("\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Z|a-z]{2,}\\b"), // Email Pattern.compile("\\bpassword[=:]['\"]?([^,'\"\\s]+)['\"]?", Pattern.CASE_INSENSITIVE), Pattern.compile("\\bapi[_-]?key[=:]['\"]?([^,'\"\\s]+)['\"]?", Pattern.CASE_INSENSITIVE), Pattern.compile("\\bsecret[=:]['\"]?([^,'\"\\s]+)['\"]?", Pattern.CASE_INSENSITIVE), Pattern.compile("\\btoken[=:]['\"]?([^,'\"\\s]+)['\"]?", Pattern.CASE_INSENSITIVE) }; @Override public String doLayout(ILoggingEvent event) { String message = super.doLayout(event); return maskSensitiveData(message); } private String maskSensitiveData(String message) { if (message == null || message.isEmpty()) { return message; } String masked = message; for (Pattern pattern : MASK_PATTERNS) { Matcher matcher = pattern.matcher(masked); StringBuffer buffer = new StringBuffer(); while (matcher.find()) { String matched = matcher.group(); String replacement; if (pattern.pattern().toLowerCase().contains("credit") || pattern.pattern().contains("4[0-9]")) { replacement = maskCreditCard(matched); } else if (pattern.pattern().contains("[0-9]{3}-[0-9]{2}-[0-9]{4}")) { replacement = "***-**-" + matched.substring(matched.length() - 4); } else if (pattern.pattern().contains("@")) { replacement = maskEmail(matched); } else { // For key=value patterns like password=secret if (matcher.groupCount() > 0 && matcher.group(1) != null) { String value = matcher.group(1); replacement = matcher.group().replace(value, "********"); } else { replacement = "********"; } } matcher.appendReplacement(buffer, Matcher.quoteReplacement(replacement)); } matcher.appendTail(buffer); masked = buffer.toString(); } return masked; } private String maskCreditCard(String cardNumber) { String digits = cardNumber.replaceAll("\\D", ""); if (digits.length() >= 4) { return "****-****-****-" + digits.substring(digits.length() - 4); } return "****"; } private String maskEmail(String email) { int atIndex = email.indexOf("@"); if (atIndex > 0) { String localPart = email.substring(0, atIndex); String domain = email.substring(atIndex); if (localPart.length() <= 2) { return "*".repeat(localPart.length()) + domain; } else { return localPart.charAt(0) + "*".repeat(localPart.length() - 2) + localPart.charAt(localPart.length() - 1) + domain; } } return email; } }

Log4j2 Custom Plugin for Masking

Log4j2 Masking Plugin

import org.apache.logging.log4j.core.*; import org.apache.logging.log4j.core.config.plugins.*; import org.apache.logging.log4j.core.layout.*; import org.apache.logging.log4j.core.pattern.*; import java.util.regex.*; @Plugin(name = "MaskingPatternLayout", category = Node.CATEGORY, elementType = Layout.ELEMENT_TYPE, printObject = true) public class MaskingPatternLayout extends PatternLayout { private final List<Pattern> maskPatterns; protected MaskingPatternLayout(String pattern, Configuration config, RegexReplacement replace, Charset charset, boolean alwaysWriteExceptions, boolean noConsoleNoAnsi) { super(config, replace, pattern, charset, alwaysWriteExceptions, noConsoleNoAnsi); this.maskPatterns = initializeMaskPatterns(); } @PluginFactory public static MaskingPatternLayout createLayout( @PluginAttribute(value = "pattern", defaultString = PatternLayout.DEFAULT_CONVERSION_PATTERN) String pattern, @PluginConfiguration Configuration config, @PluginElement("Replace") RegexReplacement replace, @PluginAttribute(value = "charset", defaultString = "UTF-8") Charset charset, @PluginAttribute(value = "alwaysWriteExceptions", defaultBoolean = true) boolean alwaysWriteExceptions, @PluginAttribute(value = "noConsoleNoAnsi", defaultBoolean = false) boolean noConsoleNoAnsi) { return new MaskingPatternLayout(pattern, config, replace, charset, alwaysWriteExceptions, noConsoleNoAnsi); } private List<Pattern> initializeMaskPatterns() { List<Pattern> patterns = new ArrayList<>(); // Credit cards patterns.add(Pattern.compile("\\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})\\b")); // SSN patterns.add(Pattern.compile("\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b")); // Email patterns.add(Pattern.compile("\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Z|a-z]{2,}\\b")); // Sensitive key-value pairs patterns.add(Pattern.compile("(?i)(password|pwd|pass)=['\"]?([^,'\"\\s]+)['\"]?")); patterns.add(Pattern.compile("(?i)(api[_-]?key|apikey)=['\"]?([^,'\"\\s]+)['\"]?")); patterns.add(Pattern.compile("(?i)(secret|token)=['\"]?([^,'\"\\s]+)['\"]?")); patterns.add(Pattern.compile("(?i)(authorization|auth):\\s*(bearer\\s+[^\\s]+)", Pattern.CASE_INSENSITIVE)); return patterns; } @Override public String toSerializable(LogEvent event) { String original = super.toSerializable(event); return maskSensitiveData(original); } private String maskSensitiveData(String message) { if (message == null || message.isEmpty()) { return message; } String masked = message; for (Pattern pattern : maskPatterns) { Matcher matcher = pattern.matcher(masked); StringBuffer buffer = new StringBuffer(); while (matcher.find()) { String replacement = getReplacement(matcher); matcher.appendReplacement(buffer, Matcher.quoteReplacement(replacement)); } matcher.appendTail(buffer); masked = buffer.toString(); } return masked; } private String getReplacement(Matcher matcher) { String matched = matcher.group(); // Handle key-value pairs if (matcher.pattern().pattern().toLowerCase().contains("password") || matcher.pattern().pattern().toLowerCase().contains("api") || matcher.pattern().pattern().toLowerCase().contains("secret") || matcher.pattern().pattern().toLowerCase().contains("token")) { if (matcher.groupCount() >= 2 && matcher.group(2) != null) { String key = matcher.group(1); String value = matcher.group(2); return key + "=********"; } } // Handle authorization headers if (matcher.pattern().pattern().toLowerCase().contains("authorization")) { if (matched.toLowerCase().startsWith("bearer")) { return "Bearer ********"; } return "********"; } // Handle specific data types if (matcher.pattern().pattern().contains("4[0-9]")) { return maskCreditCard(matched); } else if (matcher.pattern().pattern().contains("[0-9]{3}-[0-9]{2}-[0-9]{4}")) { return "***-**-" + (matched.length() >= 4 ? matched.substring(matched.length() - 4) : "****"); } else if (matcher.pattern().pattern().contains("@")) { return maskEmail(matched); } return "********"; } private String maskCreditCard(String cardNumber) { String digits = cardNumber.replaceAll("\\D", ""); if (digits.length() >= 4) { return "****-****-****-" + digits.substring(digits.length() - 4); } return "****"; } private String maskEmail(String email) { int atIndex = email.indexOf("@"); if (atIndex > 0) { String localPart = email.substring(0, atIndex); String domain = email.substring(atIndex); if (localPart.length() <= 2) { return "*".repeat(localPart.length()) + domain; } else { return localPart.charAt(0) + "*".repeat(Math.max(0, localPart.length() - 2)) + (localPart.length() > 1 ? localPart.charAt(localPart.length() - 1) : "") + domain; } } return email; } }

<!-- log4j2.xml --> <?xml version="1.0" encoding="UTF-8"?> <Configuration status="WARN" packages="com.example.logging"> <Appenders> <Console name="Console" target="SYSTEM_OUT"> <MaskingPatternLayout pattern="%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n"/> </Console> <File name="File" fileName="logs/app.log"> <MaskingPatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n"/> </File> </Appenders> <Loggers> <Root level="info"> <AppenderRef ref="Console"/> <AppenderRef ref="File"/> </Root> </Loggers> </Configuration>

Spring Boot Integration

Spring Boot Configuration with Log Masking

import org.springframework.context.annotation.*; import org.springframework.boot.context.properties.*; import java.util.*; @Configuration @ConfigurationProperties(prefix = "logging.masking") public class LogMaskingConfig { private List<String> patterns = new ArrayList<>(); private boolean enabled = true; private MaskingStrategy strategy = MaskingStrategy.PARTIAL; public enum MaskingStrategy { FULL, // Replace entire value with **** PARTIAL, // Show partial information (first/last chars) HASH // Replace with hash of the value } // Getters and setters public List<String> getPatterns() { return patterns; } public void setPatterns(List<String> patterns) { this.patterns = patterns; } public boolean isEnabled() { return enabled; } public void setEnabled(boolean enabled) { this.enabled = enabled; } public MaskingStrategy getStrategy() { return strategy; } public void setStrategy(MaskingStrategy strategy) { this.strategy = strategy; } @Bean public LogMaskingService logMaskingService() { return new LogMaskingService(this); } } @Service public class LogMaskingService { private final LogMaskingConfig config; private final List<Pattern> compiledPatterns; public LogMaskingService(LogMaskingConfig config) { this.config = config; this.compiledPatterns = compilePatterns(); } private List<Pattern> compilePatterns() { List<Pattern> patterns = new ArrayList<>(); // Add default patterns patterns.add(Pattern.compile("\\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})\\b")); patterns.add(Pattern.compile("\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b")); patterns.add(Pattern.compile("\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Z|a-z]{2,}\\b")); // Add custom patterns from configuration for (String patternStr : config.getPatterns()) { try { patterns.add(Pattern.compile(patternStr)); } catch (Exception e) { // Log warning about invalid pattern System.err.println("Invalid regex pattern: " + patternStr); } } return patterns; } public String maskMessage(String message) { if (!config.isEnabled() || message == null) { return message; } String masked = message; for (Pattern pattern : compiledPatterns) { Matcher matcher = pattern.matcher(masked); StringBuffer buffer = new StringBuffer(); while (matcher.find()) { String replacement = getMaskedReplacement(matcher.group()); matcher.appendReplacement(buffer, Matcher.quoteReplacement(replacement)); } matcher.appendTail(buffer); masked = buffer.toString(); } return masked; } private String getMaskedReplacement(String value) { switch (config.getStrategy()) { case FULL: return "*".repeat(Math.min(value.length(), 8)); case HASH: return "hash_" + Integer.toHexString(value.hashCode()); case PARTIAL: default: return maskPartial(value); } } private String maskPartial(String value) { if (value.length() <= 2) { return "*".repeat(value.length()); } // For emails if (value.contains("@")) { return maskEmail(value); } // For credit cards, SSN, etc. if (value.matches(".*\\d.*")) { if (value.replaceAll("\\D", "").length() >= 4) { return "*".repeat(value.length() - 4) + value.substring(value.length() - 4); } } // Generic masking int visibleChars = Math.max(1, value.length() / 4); return value.substring(0, visibleChars) + "*".repeat(value.length() - visibleChars * 2) + value.substring(value.length() - visibleChars); } private String maskEmail(String email) { int atIndex = email.indexOf("@"); if (atIndex > 0) { String localPart = email.substring(0, atIndex); String domain = email.substring(atIndex); String maskedLocal = localPart.length() <= 2 ? "*".repeat(localPart.length()) : localPart.charAt(0) + "*".repeat(localPart.length() - 2) + localPart.charAt(localPart.length() - 1); return maskedLocal + domain; } return email; } } // Aspect for automatic method argument masking @Aspect @Component public class LoggingAspect { private final LogMaskingService maskingService; private final Logger logger = LoggerFactory.getLogger(LoggingAspect.class); public LoggingAspect(LogMaskingService maskingService) { this.maskingService = maskingService; } @Around("execution(* com.example.service.*.*(..))") public Object logMethodCall(ProceedingJoinPoint joinPoint) throws Throwable { String methodName = joinPoint.getSignature().getName(); String className = joinPoint.getTarget().getClass().getSimpleName(); // Mask arguments before logging Object[] maskedArgs = maskArguments(joinPoint.getArgs()); String maskedArguments = Arrays.toString(maskedArgs); logger.info("Entering {}.{} with arguments: {}", className, methodName, maskedArguments); try { Object result = joinPoint.proceed(); // Mask result before logging if needed String maskedResult = maskResult(result); logger.info("Exiting {}.{} with result: {}", className, methodName, maskedResult); return result; } catch (Exception e) { logger.error("Exception in {}.{}: {}", className, methodName, e.getMessage()); throw e; } } private Object[] maskArguments(Object[] args) { if (args == null) { return new Object[0]; } Object[] masked = new Object[args.length]; for (int i = 0; i < args.length; i++) { masked[i] = maskObject(args[i]); } return masked; } private Object maskObject(Object obj) { if (obj == null) { return null; } // If it's a string, apply masking if (obj instanceof String) { return maskingService.maskMessage((String) obj); } // If it's a custom object with sensitive data, use reflection if (isSensitiveObject(obj)) { return maskSensitiveObject(obj); } return obj; } private String maskResult(Object result) { if (result == null) { return "null"; } String resultStr = result.toString(); return maskingService.maskMessage(resultStr); } private boolean isSensitiveObject(Object obj) { // Check if object has fields with @SensitiveData annotation return Arrays.stream(obj.getClass().getDeclaredFields()) .anyMatch(field -> field.isAnnotationPresent(SensitiveData.class)); } private Object maskSensitiveObject(Object obj) { // Use reflection to create a masked version of the object // This would use the AnnotationBasedMasker from earlier return AnnotationBasedMasker.maskObject(obj); } }

Application Properties Configuration

# application.yml logging: masking: enabled: true strategy: PARTIAL patterns: - "\\b[0-9]{16}\\b" # Additional 16-digit numbers - "\\b[A-Z]{2}[0-9]{6,}\\b" # License plates, etc. level: com.example: INFO org.springframework: WARN # Logback configuration (if using logback) logging: config: classpath:logback-masking.xml

Testing the Masking Implementation

Unit Tests for Masking

import org.junit.jupiter.api.*; import static org.junit.jupiter.api.Assertions.*; public class LogMaskingTest { private BasicLogMasker masker; private AnnotationBasedMasker annotationMasker; @BeforeEach void setUp() { masker = new BasicLogMasker(); annotationMasker = new AnnotationBasedMasker(); } @Test void testCreditCardMasking() { String input = "Card: 4111-1111-1111-1111"; String masked = masker.maskSensitiveData(input); assertFalse(masked.contains("4111-1111-1111-1111")); assertTrue(masked.contains("****-****-****-1111")); } @Test void testSSNMasking() { String input = "SSN: 123-45-6789"; String masked = masker.maskSensitiveData(input); assertFalse(masked.contains("123-45-6789")); assertTrue(masked.contains("***-**-6789")); } @Test void testEmailMasking() { String input = "Email: [email protected]"; String masked = masker.maskSensitiveData(input); assertFalse(masked.contains("[email protected]")); assertTrue(masked.contains("j****[email protected]")); } @Test void testAnnotationBasedMasking() { User user = new User( "johndoe", "[email protected]", "123-45-6789", "4111-1111-1111-1111", "secret123", "+1-555-123-4567" ); String masked = annotationMasker.maskObject(user); assertFalse(masked.contains("[email protected]")); assertFalse(masked.contains("123-45-6789")); assertFalse(masked.contains("4111-1111-1111-1111")); assertFalse(masked.contains("secret123")); assertTrue(masked.contains("j****e@e****e.com")); assertTrue(masked.contains("***-**-6789")); assertTrue(masked.contains("****-****-****-1111")); assertTrue(masked.contains("********")); // password } @Test void testLogMaskingService() { LogMaskingConfig config = new LogMaskingConfig(); config.setEnabled(true); config.setStrategy(LogMaskingConfig.MaskingStrategy.PARTIAL); LogMaskingService service = new LogMaskingService(config); String message = "User login: [email protected], card=4111111111111111"; String masked = service.maskMessage(message); assertFalse(masked.contains("[email protected]")); assertFalse(masked.contains("4111111111111111")); } @Test void testPerformance() { String largeMessage = "Large log message with multiple sensitive data: " + "[email protected], ssn=123-45-6789, " + "card=4111-1111-1111-1111, phone=555-123-4567. " + "Repeated multiple times for performance testing."; StringBuilder builder = new StringBuilder(); for (int i = 0; i < 1000; i++) { builder.append(largeMessage); } String largeInput = builder.toString(); long startTime = System.currentTimeMillis(); String masked = masker.maskSensitiveData(largeInput); long endTime = System.currentTimeMillis(); System.out.println("Masking performance: " + (endTime - startTime) + "ms"); // Ensure no sensitive data leaked assertFalse(masked.contains("[email protected]")); assertFalse(masked.contains("123-45-6789")); assertFalse(masked.contains("4111-1111-1111-1111")); } }

Best Practices and Recommendations

1. Comprehensive Pattern Coverage

public class ComprehensiveMaskingPatterns { public static final List<Pattern> SENSITIVE_DATA_PATTERNS = Arrays.asList( // Financial information Pattern.compile("\\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|6(?:011|5[0-9]{2})[0-9]{12}|(?:2131|1800|35\\d{3})\\d{11})\\b"), // Social security numbers Pattern.compile("\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b"), // Email addresses Pattern.compile("\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Z|a-z]{2,}\\b"), // Phone numbers (international formats) Pattern.compile("\\b(?:\\+?1[-. ]?)?\\(?[0-9]{3}\\)?[-. ]?[0-9]{3}[-. ]?[0-9]{4}\\b"), // API keys and tokens Pattern.compile("\\b(?:sk|pk)_[a-zA-Z0-9]{20,}\\b"), // Stripe-like Pattern.compile("\\bAKIA[0-9A-Z]{16}\\b"), // AWS Pattern.compile("\\bgh[pousr]_[A-Za-z0-9]{36}\\b"), // GitHub Pattern.compile("\\b[a-zA-Z0-9]{40}\\b"), // Generic 40-char tokens // Authorization headers Pattern.compile("(?i)authorization:\\s*(bearer|basic)\\s+[^\\s]+"), // Password in key-value pairs Pattern.compile("(?i)(password|pwd|pass|passphrase)[=:]['\"]?([^,'\"\\s]+)['\"]?"), // Secret keys Pattern.compile("(?i)(secret|secretkey|privatekey|apisecret)[=:]['\"]?([^,'\"\\s]+)['\"]?"), // Database connection strings Pattern.compile("(jdbc|mongodb|redis|postgresql)://[^:]+:[^@]+@[^\\s]+"), // JWT tokens Pattern.compile("\\beyJ[\\w-]+\\.[\\w-]+\\.[\\w-]+\\b"), // IP addresses (optional - based on requirement) Pattern.compile("\\b(?:[0-9]{1,3}\\.){3}[0-9]{1,3}\\b"), // MAC addresses Pattern.compile("\\b(?:[0-9A-Fa-f]{2}[:-]){5}(?:[0-9A-Fa-f]{2})\\b"), // Vehicle identification numbers Pattern.compile("\\b[A-HJ-NPR-Z0-9]{17}\\b") ); }

2. Layered Defense Strategy

public class LayeredLogMasking { // Layer 1: Pre-logging validation public void logSafely(String message, Object... args) { if (containsSensitiveData(message)) { throw new SecurityException("Attempt to log sensitive data: " + maskForValidation(message)); } // Apply masking before logging String maskedMessage = maskMessage(message); Object[] maskedArgs = maskArguments(args); logger.info(maskedMessage, maskedArgs); } // Layer 2: Runtime monitoring @Component public class LogMonitoringAspect { private final Set<String> sensitiveLogs = Collections.synchronizedSet(new HashSet<>()); @AfterReturning("execution(* org.slf4j.Logger.*(..))") public void monitorLogs(JoinPoint joinPoint) { Object[] args = joinPoint.getArgs(); if (args.length > 0 && args[0] instanceof String) { String message = (String) args[0]; if (containsUnmaskedSensitiveData(message)) { sensitiveLogs.add(message); alertSecurityTeam(message); } } } private boolean containsUnmaskedSensitiveData(String message) { // Check if message contains unmasked sensitive patterns return ComprehensiveMaskingPatterns.SENSITIVE_DATA_PATTERNS.stream() .anyMatch(pattern -> pattern.matcher(message).find()); } private void alertSecurityTeam(String message) { // Send alert to security team System.err.println("SECURITY ALERT: Unmasked sensitive data in logs: " + maskForValidation(message)); } } // Layer 3: Post-logging scanning @Component public class LogFileScanner { @Scheduled(fixedRate = 300000) // Scan every 5 minutes public void scanLogFiles() { scanLogFileForSensitiveData("logs/application.log"); scanLogFileForSensitiveData("logs/application.json"); } private void scanLogFileForSensitiveData(String filePath) { try (BufferedReader reader = new BufferedReader(new FileReader(filePath))) { String line; int lineNumber = 0; while ((line = reader.readLine()) != null) { lineNumber++; if (containsUnmaskedSensitiveData(line)) { handleSensitiveDataFound(filePath, lineNumber, line); } } } catch (IOException e) { System.err.println("Error scanning log file: " + e.getMessage()); } } private void handleSensitiveDataFound(String filePath, int lineNumber, String line) { // Log the incident System.err.printf("Sensitive data found in %s at line %d: %s%n", filePath, lineNumber, maskForValidation(line)); // Optionally: truncate or sanitize the log file // This should be done carefully in production } } }

Conclusion

Implementing comprehensive log masking in Java applications is crucial for security and compliance. Key takeaways:

1. Use Multiple Layers: Combine pattern-based, annotation-based, and framework-level masking
2. Customize for Your Needs: Adapt masking patterns based on your specific sensitive data types
3. Test Thoroughly: Ensure masking works correctly and doesn't impact performance
4. Monitor Continuously: Implement monitoring to detect unmasked sensitive data
5. Follow Compliance Requirements: Ensure your masking strategy meets regulatory requirements (GDPR, HIPAA, PCI-DSS)

By implementing these strategies, you can significantly reduce the risk of sensitive data exposure through application logs while maintaining useful logging for debugging and monitoring purposes.