ppkarwasz commented on issue #2518:
URL:
https://github.com/apache/logging-log4j2/issues/2518#issuecomment-2077155374
Hi @marcelhoelscher,
Sure, we should probably change the wording on the security page:
* `PatternLayout` **can** be use in production,
* but `PatternLayout` output is very difficult to **parse**, therefore it is
unsuitable for automatic processing.
Even a simple:
```xml
<PatternLayout pattern="%d [%t] %-5p %c - %m%n"/>
```
can contain a `CR` or `LF` character basically everywhere:
* developers can insert those characters in the name of the thread, level or
logger,
* the message and possibly the implicit `%xEx` pattern can even contain user
data.
You can configure `PatternLayout` to output one log event per line using:
```xml
<PatternLayout pattern="%enc{%d [%t] %-5p %c - %m%notEmpty{%n%xEx}}%n"
alwaysWriteExceptions="false"/>
```
but splitting the line into its components is extremely error prone.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
