title: Fortify Log Forging Issue
body: <p>We are scanning our .NET application with Fortify and need to provide some information on why Log Forging issue does not apply to us. In our code we have the following pattern, of course it is not exactly as is, I've captured the essence of what we're doing:</p>
  
  <pre><code>public static void Write(object message, 
              ICollection&lt;string&gt; categories, int priority, 
              int eventId, TraceEventType severity, string title, 
              IDictionary&lt;string, object&gt; properties)
  {
  
          LogEntry log = new LogEntry();
          string MessageToAdd = message.ToString();
  
          if (message.ToString().Length &gt; MaxLength)
              log.Message = message.ToString().Substring(0, MaxLength);
          else
              log.Message = message.ToString();
  
          log.Categories = categories;
          log.Priority = priority;
          log.EventId = eventId;
          log.Severity = severity;
          log.Title = title;
          log.ExtendedProperties = properties;
          Logwriter Logger;
          Logger.Write(log);
  }
  </code></pre>
  
  <p>So basically, we control how log entry objects are created. We restrict the message or user input to 100 characters. Hence we think that Log Forging raised by Fortify is a False Positive.</p>
  
  <p>What do you all think?</p>