2 ms·
The main design mistake is including it, by default, in the first place, rather than requiring you to specify some kinda custom appender or whatever. The idea
by bcrosby95 5y ago
The main design mistake is including it, by default, in the first place, rather than requiring you to specify some kinda custom appender or whatever.
The idea that a logging framework could lead to an RCE like this is completely bonkers. The vast majority of users just want to log straightforward data.
- layer8 5y agoI think it’s okay to allow specifying such substitution variables in the log pattern syntax specified in the logging configuration, but not interpreting the log message strings provided by the application, and certainly not on log message parameters.