SebTardif opened a new pull request, #4185:
URL: https://github.com/apache/logging-log4j2/pull/4185
`LoggerDynamicMBean.addAppender` (log4j-1.2-api JMX) calls
`OptionConverter.instantiateByClassName(..., null)` and immediately uses the
result. When the class name is invalid or not an `Appender`, instantiation
returns `null` and the next line NPEs on `appender.setName(...)`. That reaches
the host through the JMX `addAppender` operation with a bad class name.
## Failure scenario
```java
// LoggerDynamicMBean.addAppender
final Appender appender =
(Appender) OptionConverter.instantiateByClassName(appenderClass,
Appender.class, null);
appender.setName(appenderName); // NPE when instantiate returns null
```
`OptionConverter.instantiateByClassName` already logs and returns the
default (`null`) on `ReflectiveOperationException` or assignability failure.
The JMX facade must treat that as "do not attach," not as a hard crash.
## Fix
- Null-check after instantiate; `cat.error(...)` and return without
attaching.
- Sibling audit: `AppenderDynamicMBean.setLayout` has the same instantiate
pattern, but `registerLayoutMBean` already returns early when `layout == null`.
No change needed there.
## Red / green
```text
# Without fix
./mvnw -pl log4j-1.2-api test \
-Dtest=LoggerDynamicMBeanTest#addAppenderDoesNotNpeWhenClassCannotBeInstantiated
\
-Dsurefire.failIfNoSpecifiedTests=false
# FAIL: NPE at LoggerDynamicMBean.addAppender:70 setName on null
# With fix
./mvnw -pl log4j-1.2-api test -Dtest=LoggerDynamicMBeanTest \
-Dsurefire.failIfNoSpecifiedTests=false
# PASS: Tests run: 2, Failures: 0
```
Also covers the happy path: valid `ConsoleAppender` class still attaches
under the given name.
## Checklist
* Base branch: `2.x`
* Changelog:
`src/changelog/.2.x.x/fix_logger_dynamic_mbean_null_appender.xml`
* Tests: `LoggerDynamicMBeanTest` (JUnit 5, same package as package-private
`addAppender`)
* Spotless: `./mvnw spotless:check -pl log4j-1.2-api -am` clean
Related: same null-from-instantiate class as #4172 (XmlConfiguration
`parseAppender`).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
