3 ms·
> Oh and RCE might happen. You added a feature that can load plugins and query any kind of data based on user provided strings, this is completely unexpected
by josefx 5y ago
> Oh and RCE might happen.
You added a feature that can load plugins and query any kind of data based on user provided strings, this is completely unexpected and never happened before. What to call it? How about SQL injection attack, sounds about fancy enough.
If you implement feature requests without thinking about the design and security implications it has you are doomed to repeat history.
- Ygg2 5y agoLog4j maintainers didn't like the feature, they added it for backwards compatibility. > Log4j maintainers have been working sleeplessly on mitigation measures; fixes, docs, CVE, replies to inquiries, etc. Yet nothing is stopping people to bash us, for work we aren't paid for, for a feature we all dislike yet needed to keep due to backward compatibility concerns.
- NovaX 5y agoIt was added by these maintainers in 2.x and did not exist in 1.x. The maintainers are also different from 1.x developers and took the brand. They may regret their past decisions, but it was is irresponsible to claim that it was not their fault and added for backward compatibility.