Skip to content
This repository has been archived by the owner on Sep 13, 2023. It is now read-only.

Cleaned-up log4j 1.2 that disables scary networking (base=1.2.17, fully binary compatible) #17

Closed
wants to merge 27 commits into from

Commits on May 4, 2012

  1. [maven-scm] copy for tag v1_2_17

    git-svn-id: https://svn.apache.org/repos/asf/logging/log4j/tags/v1_2_17@1333769 13f79535-47bb-0310-9956-ffa450edef68
    grobmeier committed May 4, 2012
    Configuration menu
    Copy the full SHA
    a5ffe95 View commit details
    Browse the repository at this point in the history

Commits on May 6, 2012

  1. [maven-scm] copy for tag v1_2_17_rc3

    git-svn-id: https://svn.apache.org/repos/asf/logging/log4j/tags/v1_2_17_rc3@1334596 13f79535-47bb-0310-9956-ffa450edef68
    grobmeier committed May 6, 2012
    Configuration menu
    Copy the full SHA
    e10785b View commit details
    Browse the repository at this point in the history

Commits on May 26, 2012

  1. vote passed

    git-svn-id: https://svn.apache.org/repos/asf/logging/log4j/tags/v1_2_17@1342873 13f79535-47bb-0310-9956-ffa450edef68
    grobmeier committed May 26, 2012
    Configuration menu
    Copy the full SHA
    de9f0ea View commit details
    Browse the repository at this point in the history

Commits on Dec 19, 2021

  1. chore: add .gitignore

    lsimons committed Dec 19, 2021
    Configuration menu
    Copy the full SHA
    0f5446b View commit details
    Browse the repository at this point in the history
  2. docs: update copyright year

    lsimons committed Dec 19, 2021
    Configuration menu
    Copy the full SHA
    ffda834 View commit details
    Browse the repository at this point in the history
  3. docs: add a readme

    lsimons committed Dec 19, 2021
    Configuration menu
    Copy the full SHA
    de9db67 View commit details
    Browse the repository at this point in the history
  4. Configuration menu
    Copy the full SHA
    e474998 View commit details
    Browse the repository at this point in the history
  5. build: rewrite maven build for modern 2021 tools

    The new build requires JDK8 or later, and a JDK6 installed as a maven
    toolchain.
    
    Main changes include:
    * switch to Maven 3, requiring JDK7 to invoke
    * switch to latest (compatible) maven plugins, requiring JDK8 to invoke
    * introduce two profiles: toolchain (default) and no-toolchain
      * toolchain profile uses maven toolchains feature with JDK6
        (can also use JDK7) and source/target version of 1.4,
        for compatibility with JDK 1.4/5/6/7 and beyond
      * no-toolchain profile uses default system JDK with
        source/target version of 7,
        for compatibility with JDK 8/9/10/11/17 and beyond
    * stop building NTEventLogAppender.dll from maven by invoking ant
      (instead use the checked-in version)
    * replace some plugin use with resources section
    * replace some ant tasks with maven clean plugin
    * change all project metadata for correctness
    * remove duplicate LICENSE and NOTICE files and use the main ones
    * set default encoding to UTF-8 to silence some warnings
    * enable running all unit tests instead of a whitelist
    * change when and how site is generated
    * customize site templating for modern site plugin
    * remove unused and unsupported ant build files
    * update INSTALL document to match changes
    lsimons committed Dec 19, 2021
    Configuration menu
    Copy the full SHA
    a540537 View commit details
    Browse the repository at this point in the history
  6. ci: set up github actions

    Sets up a matrix build using github actions that runs on every push.
    The following combinations all work:
    
    * Toolchain 1.6, JDK 11, OS ubuntu-18.04
    * Toolchain 1.6, JDK 11, OS ubuntu-20.04
    * Toolchain 1.6, JDK 11, OS windows-2019
    * Toolchain 1.6, JDK 11, OS windows-2022
    * Toolchain 1.7, JDK 11, OS ubuntu-18.04
    * JDK 8, OS ubuntu-18.04
    * JDK 11, OS ubuntu-18.04
    * JDK 17, OS ubuntu-18.04
    * JDK 8, OS ubuntu-20.04
    * JDK 11, OS ubuntu-20.04
    * JDK 17, OS ubuntu-20.04
    * JDK 8, OS windows-2019
    * JDK 11, OS windows-2019
    * JDK 17, OS windows-2019
    * JDK 8, OS windows-2022
    * JDK 11, OS windows-2022
    * JDK 17, OS windows-2022
    lsimons committed Dec 19, 2021
    Configuration menu
    Copy the full SHA
    d648d7d View commit details
    Browse the repository at this point in the history
  7. test: delete several broken low-quality tests

    Delete several integration-style tests that are broken.
    They are not being run by the main build (because they are broken).
    lsimons committed Dec 19, 2021
    Configuration menu
    Copy the full SHA
    07aafec View commit details
    Browse the repository at this point in the history
  8. test: delete old scripts to run tests in favor of mvn test

    Now that the main build runs all tests, remove the old way of running
    them with ant or bash.
    lsimons committed Dec 19, 2021
    Configuration menu
    Copy the full SHA
    12120ee View commit details
    Browse the repository at this point in the history
  9. Configuration menu
    Copy the full SHA
    bd88008 View commit details
    Browse the repository at this point in the history
  10. Configuration menu
    Copy the full SHA
    8cf0234 View commit details
    Browse the repository at this point in the history
  11. test: do not run MDCTestCase reflection test on modern JDK

    MDCTestCase has some nasty reflection inside that is not allowed anymore
    on JDK >= 17. Detect and trap the error.
    lsimons committed Dec 19, 2021
    Configuration menu
    Copy the full SHA
    e966e75 View commit details
    Browse the repository at this point in the history
  12. test: do not use same output files from many tests

    Changes most tests to use unique output files during their runs, so that
    when they run in parallel or out-of-order or interactively they do not
    cause test failures, reducing flakyness of test runs.
    lsimons committed Dec 19, 2021
    Configuration menu
    Copy the full SHA
    05b34e9 View commit details
    Browse the repository at this point in the history
  13. Configuration menu
    Copy the full SHA
    cd146da View commit details
    Browse the repository at this point in the history
  14. docs: fix download page for 1.2.17

    Hand-picked changes from trunk
    lsimons committed Dec 19, 2021
    Configuration menu
    Copy the full SHA
    200e23f View commit details
    Browse the repository at this point in the history
  15. docs: fix some broken site content

    * Remove outdated roadmap page
    * Update navigation to link to renamed mailing lists page
    * Remove link to non-existent wiki
    lsimons committed Dec 19, 2021
    Configuration menu
    Copy the full SHA
    45901b8 View commit details
    Browse the repository at this point in the history
  16. docs: attempt to update build instructions on website

    These changes are incomplete because contributors cannot test the
    maven release plugin setup.
    lsimons committed Dec 19, 2021
    Configuration menu
    Copy the full SHA
    4a80521 View commit details
    Browse the repository at this point in the history
  17. Configuration menu
    Copy the full SHA
    7e81878 View commit details
    Browse the repository at this point in the history
  18. fix: remove insecure code from log4j.net package

    Disables:
    * JMSAppender
    * JMSSink
    * SimpleSocketServer
    * SocketHubAppender
    * SocketServer
    * SocketNode
    * TelnetAppender
    
    These classes now log an error instead of making network connections.
    
    Their external APIs remain intact to allow code using them to migrate
    without blowing up before runtime.
    
    Added tests for their remaining behavior.
    
    Adds warnings:
    * for SyslogAppender unless logging to a local loopback address
    * for SMTPAppender:
      * Does not warn about safe(r) use talking to the local loopback.
      * If using SMTPS, warn that host will not be verified (CVE-2020-9488).
        Note this commit does not actually fix the security issue. Instead
        it warns an upgrade is needed (or a change in configuration).
      * If using SMTP, warn about an unencrypted protocol.
    * deprecation warnings on disablec classes
    * deprecation for SocketAppender since it's the client side of the
      disabled server code
    lsimons committed Dec 19, 2021
    Configuration menu
    Copy the full SHA
    0e1fb96 View commit details
    Browse the repository at this point in the history
  19. fix: remove insecure code from log4j.jmx package

    Disables:
    * jmx.Agent
    
    This class now throws an error instead of making network connections.
    lsimons committed Dec 19, 2021
    Configuration menu
    Copy the full SHA
    531e972 View commit details
    Browse the repository at this point in the history
  20. fix: remove insecure code from jdbc package

    Disables:
    * JDBCAppender
    
    This class now logs an error instead of making network connections.
    lsimons committed Dec 19, 2021
    Configuration menu
    Copy the full SHA
    291837c View commit details
    Browse the repository at this point in the history
  21. fix: remove insecure code from varia package

    Disables networking in:
    * ExternallyRolledFileAppender
    
    Behavior reduces to be a normal non-rolling FileAppender.
    lsimons committed Dec 19, 2021
    Configuration menu
    Copy the full SHA
    02f7edd View commit details
    Browse the repository at this point in the history
  22. fix: allow MDC to work on Java >= 9

    Avoids trying to determine whether java >= 1.2 since if this version
    of the code loads java >= 1.4.
    lsimons committed Dec 19, 2021
    Configuration menu
    Copy the full SHA
    82fb4f0 View commit details
    Browse the repository at this point in the history
  23. Configuration menu
    Copy the full SHA
    80c7f1f View commit details
    Browse the repository at this point in the history
  24. test: disable more tests for non-toolchain runs

    Disable a set of flaky integration tests that depend on specific JDK
    behavior (usually due to expecting a specific stack trace), when not
    running using the toolchain JDK.
    lsimons committed Dec 19, 2021
    Configuration menu
    Copy the full SHA
    a7e7760 View commit details
    Browse the repository at this point in the history