You could also have a log analysis system that displays logs in the browser and has an XSS vulnerability. So that bypass isn't unique to log4j. > JSON You cou

You could also have a log analysis system that displays logs in the browser and has an XSS vulnerability. So that bypass isn't unique to log4j. > JSON You could probably write a more advanced check than just "{" that would let most JSON through while still blocking the attack.