Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Getting rid of log4j1 in the war file #8377

Merged
merged 3 commits into from
Feb 2, 2022
Merged

Getting rid of log4j1 in the war file #8377

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8f9a419
After some experimenting, a relatively simple (?) way to ensure we no…
landreev Jan 27, 2022
aae7bbb
cleanup of the log4j elimination project. (#IQSS/dataverse-security/48).
landreev Jan 31, 2022
790fe1f
OK, adding an explicit anti-log4j rule to checkstyle.xml, why not.
landreev Feb 1, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 30 additions & 6 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,8 @@
<payara.version>5.2021.5</payara.version>
<postgresql.version>42.2.19</postgresql.version>
<aws.version>1.11.762</aws.version>
<slf4j.version>1.7.32</slf4j.version>
<slf4j.version>1.7.35</slf4j.version>
<reload4j.version>1.2.18.4</reload4j.version>
<commons.io.version>2.11.0</commons.io.version>
<commons.logging.version>1.2</commons.logging.version>
<commons.lang3.version>3.12.0</commons.lang3.version>
Expand Down Expand Up @@ -223,16 +224,14 @@
<artifactId>slf4j-jdk14</artifactId>
<version>${slf4j.version}</version>
</dependency>
<!-- In *theory* the log4j12 bridge should not be made convergent, as WE decide which way logs flow.
Libraries should *only* rely on the api package. But sometimes... :-/ -->
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId>
<artifactId>jcl-over-slf4j</artifactId>
<version>${slf4j.version}</version>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>jcl-over-slf4j</artifactId>
<artifactId>jul-to-slf4j</artifactId>
<version>${slf4j.version}</version>
</dependency>

Expand All @@ -253,7 +252,7 @@
<artifactId>slf4j-jdk14</artifactId>
</dependency>

<dependency>
<dependency>
<groupId>org.passay</groupId>
<artifactId>passay</artifactId>
<version>1.6.0</version>
Expand Down Expand Up @@ -573,6 +572,11 @@
<!-- is still buggy. As an experiment, I'm using -->
<!-- a patched version I built locally. -->
<!-- (pull requests pending - L.A. -->
<!-- These locally-built XOAI libraries are still a serious debt -->
<!-- that needs to be addressed. Adding explicit "exclusion" entries -->
<!-- below for the immediate purpose of getting rid of the log4j library -->
<!-- that was being added to the project via these dependencies. (L.A. - Jan. 2022) -->
<!-- (note the reload4j explicitly added below as a replacement! -->
<dependency>
<groupId>com.lyncode</groupId>
<artifactId>xoai-common</artifactId>
Expand All @@ -582,11 +586,31 @@
<groupId>com.lyncode</groupId>
<artifactId>xoai-data-provider</artifactId>
<version>4.1.0-header-patch</version>
<exclusions>
<exclusion>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>com.lyncode</groupId>
<artifactId>xoai-service-provider</artifactId>
<version>4.1.0-header-patch</version>
<exclusions>
<exclusion>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
</exclusion>
</exclusions>
</dependency>
<!-- reload4j is a drop-in security patch/replacement for log4j1. -->
<!-- it is here because the XOAI libraries above need it. -->
<!-- (https://reload4j.qos.ch/) -->
<dependency>
<groupId>ch.qos.reload4j</groupId>
<artifactId>reload4j</artifactId>
<version>${reload4j.version}</version>
</dependency>
<!-- Added for AutoService -->
<dependency>
Expand Down
2 changes: 0 additions & 2 deletions src/main/java/edu/harvard/iq/dataverse/EjbDataverseEngine.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,8 +51,6 @@
import javax.validation.ConstraintViolation;
import javax.validation.ConstraintViolationException;

import org.apache.log4j.lf5.LogLevel;

/**
* An EJB capable of executing {@link Command}s in a JEE environment.
*
Expand Down
1 change: 0 additions & 1 deletion src/main/java/edu/harvard/iq/dataverse/util/bagit/OREMap.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@
import javax.json.JsonValue;

import org.apache.commons.lang3.exception.ExceptionUtils;
import org.apache.log4j.lf5.LogLevel;

public class OREMap {

Expand Down