[LOG4J2-1110] org.apache.logging.log4j.jul.CoreLogger.setLevel() checks for security permission too late

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.3
• Fix Version/s: 2.4
• Component/s: JUL adapter
• Assignee: Unassigned
• Reporter: Gary D. Gregory
• Created: 28/Aug/15 20:45
• Updated: 13/Apr/22 09:30
• Resolved: 28/Aug/15 20:55

Description

org.apache.logging.log4j.jul.CoreLogger.setLevel() checks for security permission too late.

The JUL Javadocs https://docs.oracle.com/javase/7/docs/api/java/util/logging/Logger.html#setLevel(java.util.logging.Level) state:

Throws:
SecurityException - if a security manager exists and if the caller does not have LoggingPermission("control").

Our impl org.apache.logging.log4j.jul.CoreLogger.setLevel(Level):

    @Override
    public void setLevel(final Level level) throws SecurityException {
        logger.setLevel(LevelTranslator.toLevel(level));
        super.doSetLevel(level);
    }

Checks for perms through super.doSetLevel(level) which is too late since our logger is already modified.

The fix is to switch the two calls:

    @Override
    public void setLevel(final Level level) throws SecurityException {
        super.doSetLevel(level);
        logger.setLevel(LevelTranslator.toLevel(level));
    }

Issue Links

• is related to: LOG4J2-3476 Support JUL ApiLogger::setLevel