ramanathan1504 commented on PR #4217:
URL: https://github.com/apache/logging-log4j2/pull/4217#issuecomment-5153319147
The section only covers availability. The other half of what @ppkarwasz
asked for
on #4181 is the threat model side: an untrusted key doesn't just create more
appenders,
it ends up inside their config. I tried it on 2.26.1 and with
fileName="logs/${ctx:userId}.log" and a key of ../../../../tmp/x it writes
/tmp/x.log
and doesn't report an error. One thing to watch: the key has to be a whole
path segment
for that to happen. logs/user-${ctx:userId}.log just fails to open, so the
example
matters. Could you also add the threat model link he mentioned
(https://logging.apache.org/security.html#threat-common-sources-configuration)
and a
line on why Routing is different from appenders that get built at config
time?
@ppkarwasz can you look on this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
