5 ms·
> I don't get what the point of this feature even is. This is basically the response to every type of vulnerability that is based on some spec nobody's read. S
by BeefWellington 5y ago
> I don't get what the point of this feature even is.
This is basically the response to every type of vulnerability that is based on some spec nobody's read. Same deal with XML entity parsing. Why should it make web requests, FTP requests, etc.?
At some point someone had it as a requirement and everyone else gets to live with it.
- throw_nbvc1234 5y agoWhich is why they removed the functionality in the latest version (per comments below) right?
- tmm1 5y agoNot removed: https://github.com/apache/logging-log4j2/commit/d82b47c6fae9c15fcb183170394d5f1a01ac02d3 https://github.com/apache/logging-log4j2/commit/d82b47c6fae9...
- Quekid5 5y agoHoly moley, that's a lot of extra code... any bets on if it might contain new vulnerabilities? :)
- justinpombrio 5y agoHahaha, giving you an upvote because new vulnerabilities have, in fact, been found. (And I think one of them relates to this new code not being sufficient? Though I'm not following much anymore.)
- scottlamb 5y agoThere are two bizarre design decisions that combined into this stunning security vulnerability: the automatic trust-the-world code execution (on by default) and the recursive parameter expansion (always on). They flipped the default on the former. They haven't done anything about the latter, AFAIK. I wonder if they will.