3 ms·

So, again, why is log4j "evaluating" stuff in log strings? This is the root cause that people should be addressing Why are people still using JDNI? It is frail

So, again, why is log4j "evaluating" stuff in log strings? This is the root cause that people should be addressing Why are people still using JDNI? It is frail enough to have logs depend on a dns lookup, I can't imagine depending on a LDAP lookup. This is not such a fundamental issue as the above but it is pretty dangerous. Oh yes and of course one of the worse and least pythonic package in the Python standard library was "inspired" by the log4j monstrosity

wiether 5y ago
Because a few years back it was all the hype and the Java community doesn't like deprecating stuff.
cesarb 5y ago
> Why are people still using JDNI? Because "java:comp/env" is the way for a J2EE web application to get values or objects from the configuration outside its container. Yes, nobody actually uses the remote parts of JNDI anymore, but the local variant (within the same process) is still in use. And that's what led to this vulnerability: someone wanted to be able to get these local values within the logging configuration, which is a valid use case. Not realizing that this opened the door to remote values and objects.