From 8810f4314d687c3cb57a28016341ed442a55780d Mon Sep 17 00:00:00 2001
From: Leonard Ehrenfried <mail@leonard.io>
Date: Mon, 13 Dec 2021 10:53:17 +0100
Subject: [PATCH] Remove JndiLookup class from shaded jar

---
 pom.xml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pom.xml b/pom.xml
index 19916a6b7..27af10918 100644
--- a/pom.xml
+++ b/pom.xml
@@ -189,6 +189,14 @@
                                 <exclude>META-INF/*.SF</exclude>
                                 <exclude>META-INF/*.DSA</exclude>
                                 <exclude>META-INF/*.RSA</exclude>
+                                <!--
+                                    This mitigates against the log4j JNDI lookup vulnerability: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
+
+                                    Since we are using an old version of elastic search that is incompatible with a patched, newer version of log4j we
+                                    have to remove the class JndiLookup from the fat jar. This is the recommended course of action when you cannot upgrade
+                                    as per https://logging.apache.org/log4j/2.x/security.html
+                                -->
+                                <exclude>org/apache/logging/log4j/core/lookup/JndiLookup.class</exclude>
                             </excludes>
                         </filter>
                     </filters>