2 ms·
I thought log4j performed no escaping so even if you use its logging calls that take parameters you’re still vulnerable?
by thom 5y ago
I thought log4j performed no escaping so even if you use its logging calls that take parameters you’re still vulnerable?
- layer8 5y agoThat was changed with version 2.16. The lookups are not applied to either the message format or the message arguments anymore, only to log patterns defined in the configuration.