[logback-dev] [JIRA] (LOGBACK-1591) Possibility of vulnerability

[QOS.CH (JIRA)]

Title: Message Title

Michael Osipov commented on LOGBACK-1591   Re: Possibility of vulnerability Something is really fishly here and both the report and fix are hasty. cn-panda is partially proving: Caution, water is wet! He processes unsanitized multipart input and persists to disk. This is not a Logback issue and I told him so, this is a general issue. Very very constructed since you need to start fuzzing for the logback config file. Morever this demo is incomplete because there is no code how launches the calculator. Anyway, the complete removal of the JNDI code is just wrong. It completely breaks valid usecases: <configuration> <insertFromJNDI env-entry-name="java:comp/env/context/baseName" as="contextName" /> <contextName>${contextName}</contextName> <appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender"> <file>${catalina.base}/logs/${CONTEXT_NAME}.log</file> <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy"> <!-- daily rollover --> <fileNamePattern>${catalina.base}/logs/${CONTEXT_NAME}.log.%d.gz</fileNamePattern> <maxHistory>30</maxHistory> </rollingPolicy> <encoder> <pattern>%-27(%d{HH:mm:ss.SSS} [%.-12thread]) %-22([%.-20X{ad.displayName}]) %-5level %logger{36} - %msg%n</pattern> </encoder> </appender> <root level="INFO"> <appender-ref ref="FILE" /> </root> </configuration> I would expect Logback to simply limit the JNDI namespace to java: which should be in the local VM and that's it. No more other URL providers, but local ones. Btw, this is actually contained in the fix in Log4J2. Add Comment   This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

_______________________________________________
logback-dev mailing list
logback-dev@qos.ch
http://mailman.qos.ch/mailman/listinfo/logback-dev