Log Forging in DispatcherServlet via requestURI

There is an security issue on line 843/844. An attacker can manipulate the log via malicious request.

The method doService extracts the URI from the request and uses it unvalidated.

Source:

logger.debug("DispatcherServlet with name '" + getServletName() + "'" + resumed +
		" processing " + request.getMethod() + " request for [" + requestUri + "]");

An attacker can forge the log by sending a request containing %0D%0A

Like: /app/home%0D%0AFAKE

The log will looks like:

08:34:50.145 [http-bio-8080-exec-1] DEBUG o.s.web.servlet.DispatcherServlet - DispatcherServlet with name 'dispatcher' processing GET request for [/app/home
FAKE]