-
Notifications
You must be signed in to change notification settings - Fork 1.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Hardens PropertiesUtil
against recursive property sources
#3263
Conversation
As showed in #3252, Spring's `JndiPropertySource` not only can throw exceptions, but can also perform logging calls. Such a call causes a recursive call to `PropertiesUtil.getProperty("log4j2.flowMessageFactory"`) and a `StackOverflowException` in the best scenario. The worst scenario includes a deadlock. This PR: - Moves the creation of the default `MessageFactory` and `FlowMessageFactory` to the static initializer of `LoggerContext`. This should be close enough to the pre-2.23.0 location in `AbstractLogger`. The `LoggerContext` class is usually initialized, before Spring Boot adds its property sources to `PropertiesUtil`. - Adds a check to `PropertiesUtil` to ignore recursive calls. Closes #3252.
...-test/src/test/java/org/apache/logging/log4j/core/LoggerMessageFactoryCustomizationTest.java
Outdated
Show resolved
Hide resolved
...-test/src/test/java/org/apache/logging/log4j/core/LoggerMessageFactoryCustomizationTest.java
Show resolved
Hide resolved
log4j-api-test/src/test/java/org/apache/logging/log4j/util/PropertiesUtilTest.java
Outdated
Show resolved
Hide resolved
The constructor is effectively package-private, since it has a package-private class (`AsyncLoggerDisruptor`) in its signature.
Hi @ppkarwasz, Can you please consider change back AsyncLogger constructor package-private access back to public? I've extended AsyncLogger class with the same package name to build a customized AsyncLogger and use reflection to initial customized AsyncLogger. This code was working for more than 7 years and blocked in 2.24.3 with this PR code change. Thanks, |
Hi @sundaybluesky,
Sure, please open a new feature request. In the new feature request, can you explain how are you using
That is the problem with using reflection to access private methods or classes like Note: As far as I understand you called the constructor of |
Hi @ppkarwasz , Thanks for you quick response. I created #3527 to track this issue, please help to take a look. Regards, |
As showed in #3252, Spring's
JndiPropertySource
not only can throw exceptions, but can also perform logging calls. Such a call causes a recursive call toPropertiesUtil.getProperty("log4j2.flowMessageFactory"
) and aStackOverflowException
in the best scenario. The worst scenario includes a deadlock.This PR:
MessageFactory
andFlowMessageFactory
to the static initializer ofLoggerContext
. This should be close enough to the pre-2.23.0 location inAbstractLogger
. TheLoggerContext
class is usually initialized, before Spring Boot adds its property sources toPropertiesUtil
.PropertiesUtil
to ignore recursive calls.Closes #3252.