3 ms·
Yes, it's like a format string bug in C in that sense. Most people don't take "log injection" that seriously as a bug class in Java. There are usually no conse
by xyzzy123 5y ago
Yes, it's like a format string bug in C in that sense.
Most people don't take "log injection" that seriously as a bug class in Java. There are usually no consequences for ignoring it, so it's common. The RCE adds a lot of flavour to an otherwise bland bug.
- xyzzy123 5y agoNOTE: I WAS WRONG, AS DISCUSSED UPTHREAD. IT IS EXPLOITABLE EVEN IF YOU USE FORMAT STRINGS CORRECTLY.