| Hi René
I used Henrique’s fork to help us advance our Wonder fork to slf4j.
I commented out references to classes in ERXLog4j2LoggingAdapter and ERXLogbackLoggingAdapter because we still have an ant based build and I don’t know how to specify optional dependencies as he seems to have done in the pom.xml for maven.
I am moving classes to separate frameworks as you and him had discussed. For example, ERLog4j1Extensions, ERLog4j2Extensions and ERLogbackExtensions.
The application decides which logging library to use by adding one of these to their .classpath / pom.xml.
For this to work I moved the slf4j log4j1 binding library from ERJars to ERLog4j1Extensions. I also rewrote the currentBinding() and createLoggingAdapter() in ERXLoggingUtilities to look up classes by name rather than referencing the classes directly which requires optional dependency for the code to compile.
My application is working and using ERLog4j1Extensions.
I’m am converting ERXPatternLayout and its converter classes to their equivalent in log4j2 and I will be putting them in the ERLog4j2Extensions framework.
Once I have completed that portion and can launch my app successfully I’ll report back.
Ricardo Parada
On Jan 31, 2023, at 10:42 AM, Ricardo Parada <rpar...@mac.com> wrote:
Hi René,
I’m wondering if he got hired by Apple since I have not seen any activity from him since then. :-)
Anyways, in the coming months I may start trying it out. And possibly start converting some of the appenders and pattern layout classes from log4j1 to log4j2. I found some good articles with examples on how those get implemented for log4j2.
I also saw your suggestion about perhaps moving those library specific classes to their own framework, e.g. ERXLog4jExtensions, ERXLog4j2Extensions, ERXLogbackExtensions.
We’re still using an ant based build.
I’m our code base we split the JavaXML framework into 3 separate frameworks (one for log4j, one for WSDL, and another one for the rest).
Regards, Ricardo Parada
On Jan 27, 2023, at 4:04 AM, René Bock <b...@salient-doremus.de> wrote:
Hi,
I successfully merged Henriques PR into our Wonder-fork and we are using log4j2 now for our current projects.
But in order to get rid of the log4j1.jar, we had to move form ant to maven build. And kick out the JavaXML.framework.
I'll like to support Henrique in finalising this PR, but unfortunately, I got no reply from him :-(
Regards,
René
Hi Henrique,
It is true that Wonder uses mostly the Apache commons logging library, e.g. org.apache.commons.logging and a little bit of the log4j 1 library, e.g. org.apache.log4j. That
is what I concluded b searching *.jar and *.java files in Wonder.
And you mention it in your list of open issues on your pull request, e.g. open issue # 2.8
I do not see Wonder using log4j 2, e.g. org.apache.logging.log4j. So I think technically, it is not affected by vulnerabilities CVE-2021-44228 and CVE-2021-45046 which I’ve been asked to address in our code base.
I am interested in your pull request [1]. I took a look at it and I see you have a couple issues left to resolve. For instance, updating five classes that currently extend log4j1 classes. Any progress on that?
Do you see this being merged to Wonder anytime soon?
Will you wait until the 3 open issues have all been resolved?
Is anybody else using it and/or helping you?
I’m thinking of applying your pull request to our version of Wonder to see how well it works with our code base.
Using slf4j in Wonder and letting the developer choose the actual logging library seems like a winning strategy to me.
Thank you,
Ricardo Parada
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Webobjects-dev mailing list ( Webobjects-dev@lists.apple.com)
Help/Unsubscribe/Update your Subscription:
https://lists.apple.com/mailman/options/webobjects-dev/bock%40salient-doremus.de
This email sent to b...@salient-doremus.de
|
