This is an automated email from the ASF dual-hosted git repository. ppkarwasz pushed a commit to branch fix/2.x/xml-entity-restrictions-docs in repository https://gitbox.apache.org/repos/asf/logging-log4j2.git
commit c05fd820e3a18782e2ec5e0ee0437a1f2e105126 Author: Piotr P. Karwasz <[email protected]> AuthorDate: Sun Aug 30 11:29:48 2026 +0200 docs: document location restrictions on Log4j 1 external entities Since version 2.27.0 (#4198), the external subset and other external entities in Log4j 1 XML configuration files are resolved through `ConfigurationSource`, so they can only be retrieved from locations allowed by the `log4j2.configurationAllowedProtocols` property. Document this in the migration guide and in the Javadoc of the bridge `XmlConfiguration`. Assisted-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01LNsw2hhNuJ6tjsEU2tChnn --- .../src/main/java/org/apache/log4j/xml/XmlConfiguration.java | 7 +++++++ src/site/antora/modules/ROOT/pages/migrate-from-log4j1.adoc | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/log4j-1.2-api/src/main/java/org/apache/log4j/xml/XmlConfiguration.java b/log4j-1.2-api/src/main/java/org/apache/log4j/xml/XmlConfiguration.java index 3ccb37a9fd..1295a63690 100644 --- a/log4j-1.2-api/src/main/java/org/apache/log4j/xml/XmlConfiguration.java +++ b/log4j-1.2-api/src/main/java/org/apache/log4j/xml/XmlConfiguration.java @@ -18,6 +18,7 @@ package org.apache.log4j.xml; import java.io.IOException; import java.io.InterruptedIOException; +import java.net.URI; import java.util.HashMap; import java.util.Map; import java.util.Properties; @@ -77,6 +78,12 @@ import org.xml.sax.SAXParseException; * Parsing and validation errors do not stop the configuration process; they are printed as warnings to the status * logger. * </p> + * <p> + * Since version <strong>2.27.0</strong>, external entities are resolved through + * {@link ConfigurationSource#fromUri(URI)}, so they can only be retrieved from locations allowed by the + * <a href="https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.configurationAllowedProtocols";>{@code log4j2.configurationAllowedProtocols}</a> + * configuration property. + * </p> */ public class XmlConfiguration extends Log4j1Configuration { diff --git a/src/site/antora/modules/ROOT/pages/migrate-from-log4j1.adoc b/src/site/antora/modules/ROOT/pages/migrate-from-log4j1.adoc index a4434e1e70..901ff650d3 100644 --- a/src/site/antora/modules/ROOT/pages/migrate-from-log4j1.adoc +++ b/src/site/antora/modules/ROOT/pages/migrate-from-log4j1.adoc @@ -360,6 +360,13 @@ and xref:manual/configuration.adoc#configuration-attribute-schema[`schema`] attributes of the XML configuration format. +[NOTE] +==== +Since version `2.27.0`, the external subset and other external entities can only be retrieved from locations allowed by the +xref:manual/systemproperties.adoc#log4j2.configurationAllowedProtocols[`log4j2.configurationAllowedProtocols`] +property. +==== + [#configuration-appenders] ==== Appenders
