Thanks for reaching out, Travis! I don't have much of an experience in
log4j-jpl, but after a 15min check, this definitely seems like a bug to me.
(`MessageFormatMessage` should have been used instead of
`ParametrizedMessage`, I guess.) Mind filling in a JIRA ticket along with
your findings, please?
On Tue, Jan 4, 2022 at 3:22 PM Travis Spencer <travis.spen...@curity.io>
wrote:
> Hi All,
>
> I just learned about the Log4j JDK Platform Logging Adapter. I added
> log4j-jpl-2.17.1.jar to my class path.
>
> I added this to my log4j config file:
>
> <Logger name="java.io.serialization" level="TRACE" />
>
> Now, I see this in my log file:
>
> 2022-01-04T15:05:52:849+0100 TRACE 8P1u2Wr5 dd4ec2e6 {req-169}
> java.io.serialization:-1 ObjectInputFilter {0}: {1}, array length: {2},
> nRefs: {3}, depth: {4}, bytes: {5}, ex: {6}
>
> Looking at the OpenJDK 11 code at
> java.base/java/io/ObjectInputStream.java:1345, I see this:
>
> Logging.filterLogger.log(status == null || status ==
> ObjectInputFilter.Status.REJECTED
> ? Logger.Level.DEBUG
> : Logger.Level.TRACE,
> "ObjectInputFilter {0}: {1}, array length: {2},
> nRefs: {3}, depth: {4}, bytes: {5}, ex: {6}",
> status, clazz, arrayLength, totalObjectRefs, depth,
> bytesRead,
> Objects.toString(ex, "n/a"));
>
> This logger seems to be set above this on line 300ish:
>
> static {
> Logger filterLog = System.getLogger("java.io.serialization");
> filterLogger = (filterLog.isLoggable(Logger.Level.DEBUG)
> || filterLog.isLoggable(Logger.Level.TRACE)) ?
> filterLog : null;
> }
>
> So, the placeholders don't seem to get changed for their parameter values.
> Do I need to do something more in the Log4j JDK Platform Logging Adapter to
> make this work or is this perhaps a bug?
>
> TIA!
>
> --
>
> Regards,
>
> Travis Spencer
>
