Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Getting rid of log4j1 in the war file #8377

Merged
merged 3 commits into from
Feb 2, 2022
Merged

Getting rid of log4j1 in the war file #8377

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8f9a419
After some experimenting, a relatively simple (?) way to ensure we no…
landreev Jan 27, 2022
aae7bbb
cleanup of the log4j elimination project. (#IQSS/dataverse-security/48).
landreev Jan 31, 2022
790fe1f
OK, adding an explicit anti-log4j rule to checkstyle.xml, why not.
landreev Feb 1, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 47 additions & 3 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,8 @@
<payara.version>5.2021.5</payara.version>
<postgresql.version>42.2.19</postgresql.version>
<aws.version>1.11.762</aws.version>
<slf4j.version>1.7.32</slf4j.version>
<slf4j.version>1.7.35</slf4j.version>
<reload4j.version>1.2.18.4</reload4j.version>
<commons.io.version>2.11.0</commons.io.version>
<commons.logging.version>1.2</commons.logging.version>
<commons.lang3.version>3.12.0</commons.lang3.version>
Expand Down Expand Up @@ -225,16 +226,25 @@
</dependency>
<!-- In *theory* the log4j12 bridge should not be made convergent, as WE decide which way logs flow.
Libraries should *only* rely on the api package. But sometimes... :-/ -->
<!-- Replacing the dependency slf4j-log4j12 with slf4j-reload4j, -->
<!-- in order to make sure we are getting rid of log4j for good... -->
<!-- it may not be necessary, to include slf4j-reload4j explicitly -->
<!-- but shouldn't hurt either (? L.A. - Jan. 2022) -->
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId>
<artifactId>slf4j-reload4j</artifactId>
<version>${slf4j.version}</version>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>jcl-over-slf4j</artifactId>
<version>${slf4j.version}</version>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>jul-to-slf4j</artifactId>
<version>${slf4j.version}</version>
</dependency>

</dependencies>
</dependencyManagement>
Expand All @@ -252,7 +262,25 @@
<groupId>org.slf4j</groupId>
<artifactId>slf4j-jdk14</artifactId>
</dependency>

<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>jcl-over-slf4j</artifactId>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>jul-to-slf4j</artifactId>
</dependency>
<!-- reload4j is a drop-in security patch/replacement for log4j1. -->
<!-- (https://reload4j.qos.ch/) -->
<dependency>
<groupId>ch.qos.reload4j</groupId>
<artifactId>reload4j</artifactId>
<version>${reload4j.version}</version>
</dependency>
<dependency>
<groupId>org.passay</groupId>
<artifactId>passay</artifactId>
Expand Down Expand Up @@ -573,6 +601,10 @@
<!-- is still buggy. As an experiment, I'm using -->
<!-- a patched version I built locally. -->
<!-- (pull requests pending - L.A. -->
<!-- These locally-built XOAI libraries are still a serious debt -->
<!-- that needs to be addressed. Adding explicit "exclusion" entries -->
<!-- below for the immediate purpose of getting rid of the log4j library -->
<!-- that was being added to the project via these dependencies. (L.A. - Jan. 2022) -->
<dependency>
<groupId>com.lyncode</groupId>
<artifactId>xoai-common</artifactId>
Expand All @@ -582,11 +614,23 @@
<groupId>com.lyncode</groupId>
<artifactId>xoai-data-provider</artifactId>
<version>4.1.0-header-patch</version>
<exclusions>
<exclusion>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>com.lyncode</groupId>
<artifactId>xoai-service-provider</artifactId>
<version>4.1.0-header-patch</version>
<exclusions>
<exclusion>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
</exclusion>
</exclusions>
</dependency>
<!-- Added for AutoService -->
<dependency>
Expand Down
2 changes: 1 addition & 1 deletion src/main/java/edu/harvard/iq/dataverse/EjbDataverseEngine.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@
import javax.validation.ConstraintViolation;
import javax.validation.ConstraintViolationException;

import org.apache.log4j.lf5.LogLevel;
//import org.apache.log4j.lf5.LogLevel;

/**
* An EJB capable of executing {@link Command}s in a JEE environment.
Expand Down
2 changes: 1 addition & 1 deletion src/main/java/edu/harvard/iq/dataverse/util/bagit/OREMap.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
import javax.json.JsonValue;

import org.apache.commons.lang3.exception.ExceptionUtils;
import org.apache.log4j.lf5.LogLevel;
//import org.apache.log4j.lf5.LogLevel;

public class OREMap {

Expand Down