SebTardif commented on PR #4217:
URL: https://github.com/apache/logging-log4j2/pull/4217#issuecomment-5154651940
Thanks @ramanathan1504. Pushed an update that:
- Splits the section into **Resource allocation** and **Threat model**
- Notes that default routes build subordinate appenders **at runtime**, so
lookups can still carry untrusted data when attributes are resolved (unlike
config-time appenders)
- Adds the path-segment `fileName="logs/${ctx:userId}.log"` example (and the
contrast with `logs/user-${ctx:userId}.log`)
- Links the [configuration sources threat
model](https://logging.apache.org/security.html#threat-common-sources-configuration)
and the [path traversal
FAQ](https://logging.apache.org/security/faq.html#path-traversal)
- Extends mitigations to path/URL/sink interpolation
Happy to adjust wording if @ppkarwasz wants a different emphasis.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
