SebTardif opened a new pull request, #4219:
URL: https://github.com/apache/logging-log4j2/pull/4219
## What Problem This Solves
`AppenderDynamicMBean.invoke("setLayout")` calls
`OptionConverter.instantiateByClassName(..., null)` and immediately passes the
result to `appender.setLayout(...)`. When the class name is invalid or not a
`Layout`, instantiation returns null and the next line NPEs. Same pattern as
`LoggerDynamicMBean.addAppender` (#4185).
## Evidence
### Failure scenario
```java
final Layout layout =
(Layout) OptionConverter.instantiateByClassName((String) params[0],
Layout.class, null);
appender.setLayout(layout); // NPE when instantiate returns null
```
### Red-green / tests
```bash
export JAVA_HOME=$(/usr/libexec/java_home -v 17)
./mvnw -pl log4j-1.2-api -am test \
-Dtest=AppenderDynamicMBeanTest \
-Dsurefire.failIfNoSpecifiedTests=false
```
- Invalid class: no NPE, layout remains null
- Valid `PatternLayout`: layout attached
### Sibling audit
- `LoggerDynamicMBean.addAppender`: already guarded in #4185
- `registerLayoutMBean`: already null-safe
- No other `instantiateByClassName` + immediate dereference in
`log4j-1.2-api` JMX package
## Summary
Null-check + error log on failed layout instantiation; unit tests +
changelog.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
