marcelhoelscher opened a new issue, #2518: URL: https://github.com/apache/logging-log4j2/issues/2518
Hello, I came across the following statement on the Log4J security page (https://logging.apache.org/security.html#reporting):  This text suggests that PatternLayout in Log4j should not be utilized in production environments. This information was both surprising and new to myself and my team members. Beyond the aforementioned link, there appears to be no indication within the official Log4J documentation that PatternLayout is unsuitable for production use. In particular, such a warning is not present where a developer would typically look for information regarding PatternLayout (for example, here: https://logging.apache.org/log4j/2.x/manual/layouts.html). Additionally, the Log4j documentation for PatternLayout asserts that log injection attacks can be mitigated by employing the wrapper pattern converter "%enc{%m}{CRLF}" within PatternLayout. However, it fails to mention that this mechanism does not work under all circumstances. Consequently, developers may opt to use PatternLayout in production, under the false assumption that they are safeguarded against log injection scenarios by using %enc{%m}{CRLF}, even when this protection is not guaranteed. Could you please address and document these aspects of PatternLayout more explicitly to prevent any potential misunderstandings? Kind regards -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
