4 ms·

Which is why they removed the functionality in the latest version (per comments below) right?

• tmm1 5y ago
  Not removed: https://github.com/apache/logging-log4j2/commit/d82b47c6fae9c15fcb183170394d5f1a01ac02d3 https://github.com/apache/logging-log4j2/commit/d82b47c6fae9...
  • Quekid5 5y ago
    Holy moley, that's a lot of extra code... any bets on if it might contain new vulnerabilities? :)
    • justinpombrio 5y ago
      Hahaha, giving you an upvote because new vulnerabilities have, in fact, been found. (And I think one of them relates to this new code not being sufficient? Though I'm not following much anymore.)
• scottlamb 5y ago
  There are two bizarre design decisions that combined into this stunning security vulnerability: the automatic trust-the-world code execution (on by default) and the recursive parameter expansion (always on). They flipped the default on the former. They haven't done anything about the latter, AFAIK. I wonder if they will.