4 ms·
Am I understanding this correctly. You are vulnerable if you log user input, for example especially if it is on a public facing API.
by saberdancer 5y ago
Am I understanding this correctly. You are vulnerable if you log user input, for example especially if it is on a public facing API.
- john37386 5y agoYou read it right. Just a simple curl can infect your system. Your api can be behind multiple layer of security and still it will reach log4j and infect your system.
- foobiekr 5y agoYou should never be logging user input non-escaped anyway. At the very least, that creates a hazard where someone might be fooled as to the correct behavior/false-internal-systems-corroboration by logging something misleading that masquerades as a legitimate log message. It is a _huge_ hazard.