Uploaded image for project: 'Log4j 2'
  1. Log4j 2
  2. LOG4J2-2274

Allow EnvironmentPropertySource to run with a SecurityManager that rejects environment variable access

    Details

    • Type: Improvement
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 2.10.0
    • Fix Version/s: 2.11.0, 3.0.0
    • Component/s: Core
    • Labels:
      None

      Description

      Please find attached to this email a code change proposal for the EnvironmentPropertySource so it does not  fail when used in conjonction with highly restrictive security restriction managers.

      I propose to surround with a try..catch the retrieval of environment variables so the library does not fail to initialize when it runs in the context of a security manager that always issues Exception when security rules are violated.

      see attachment for proposal.

      Avoids:

      java.lang.NoClassDefFoundError: Could not initialize class org.apache.logging.log4j.util.PropertiesUtil
          at org.apache.logging.log4j.status.StatusLogger.<clinit>(StatusLogger.java:78)
          at org.apache.logging.log4j.core.AbstractLifeCycle.<clinit>(AbstractLifeCycle.java:38)
          at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
          at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
          at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
          at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
          at org.apache.logging.log4j.core.config.builder.impl.DefaultConfigurationBuilder.build(DefaultConfigurationBuilder.java:172)
          at org.apache.logging.log4j.core.config.builder.impl.DefaultConfigurationBuilder.build(DefaultConfigurationBuilder.java:161)
          at org.apache.logging.log4j.core.config.builder.impl.DefaultConfigurationBuilder.build(DefaultConfigurationBuilder.java:1)
          at org.apache.logging.log4j.util.EnvironmentPropertySourceSecurityManagerTest.test(EnvironmentPropertySourceSecurityManagerTest.java:55)
      

        Attachments

        1. TestSecManager.java
          1 kB
          Sebastien Lannez
        2. EnvironmentPropertySource.java
          2 kB
          Sebastien Lannez

          Issue Links

            Activity

              People

              • Assignee:
                garydgregory Gary Gregory
                Reporter:
                slannez Sebastien Lannez
              • Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: