If you log any sort of input from outside, then attackers get to supply their own URLs. This will trigger even if you're doing it yourself because log4j also k

If you log any sort of input from outside, then attackers get to supply their own URLs. This will trigger even if you're doing it yourself because log4j also keeps recursively expanding macros in the log string until no more are found. So parameterizing your log statements isn't a defense against this the way parameterizing your SQL statements would be for SQL injection.