5 ms·
our applications cannot make outbound connections from logging (they have to go through a specific class/function/service/factory that sets up all the metadata
by ev1 5y ago
our applications cannot make outbound connections from logging (they have to go through a specific class/function/service/factory that sets up all the metadata like mTLS, proxy, etc), and any non-mTLS attempts don't work, along with any to "not recognised" endpoints.
I noticed on thursday thanks to HN and mitigated before 2.15.0 released, and have done nothing all weekend.
i want to know who the fuck on earth actually has a use case of loading a class and running it inline from a logging call rather than calling getUserEmailFromLdap(ou, principal).toString() or something
- thrashh 5y agoIMO I don’t think the actual feature is bad. I think the real problem is that some people consider logging messages data that must be sanitized (like SQL) while others don’t. And when you mix these two groups of people, we have very major problems.
- ev1 5y agoif at least anything "downloading executable code from elsewhere and running it" needs to be severely, excessively opt in behaviour. the actual feature feels incredibly strange to me as someone that has written in a ton of languages and always explicitly treated it as a plain text string unless very explicitly intended to format it