[LOG4J2-2274] Allow EnvironmentPropertySource to run with a SecurityManager that rejects environment variable access

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.10.0
• Fix Version/s: 2.11.0, 3.0.0
• Component/s: Core
• Assignee: Gary D. Gregory
• Reporter: Sebastien Lannez
• Created: 27/Feb/18 15:41
• Updated: 01/Mar/18 17:24
• Resolved: 01/Mar/18 15:32

Description

Please find attached to this email a code change proposal for the EnvironmentPropertySource so it does not  fail when used in conjonction with highly restrictive security restriction managers.

I propose to surround with a try..catch the retrieval of environment variables so the library does not fail to initialize when it runs in the context of a security manager that always issues Exception when security rules are violated.

see attachment for proposal.

Avoids:

java.lang.NoClassDefFoundError: Could not initialize class org.apache.logging.log4j.util.PropertiesUtil
    at org.apache.logging.log4j.status.StatusLogger.<clinit>(StatusLogger.java:78)
    at org.apache.logging.log4j.core.AbstractLifeCycle.<clinit>(AbstractLifeCycle.java:38)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
    at org.apache.logging.log4j.core.config.builder.impl.DefaultConfigurationBuilder.build(DefaultConfigurationBuilder.java:172)
    at org.apache.logging.log4j.core.config.builder.impl.DefaultConfigurationBuilder.build(DefaultConfigurationBuilder.java:161)
    at org.apache.logging.log4j.core.config.builder.impl.DefaultConfigurationBuilder.build(DefaultConfigurationBuilder.java:1)
    at org.apache.logging.log4j.util.EnvironmentPropertySourceSecurityManagerTest.test(EnvironmentPropertySourceSecurityManagerTest.java:55)

Issue Links

• is related to: LOG4J2-2279 Allow SystemPropertiesPropertySource to run with a SecurityManager that rejects system property access