[LOG4J2-2279] Allow SystemPropertiesPropertySource to run with a SecurityManager that rejects system property access

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.10.0
• Fix Version/s: 2.11.0, 3.0.0
• Component/s: API
• Assignee: Gary D. Gregory
• Reporter: Gary D. Gregory
• Created: 01/Mar/18 17:23
• Updated: 01/Mar/18 23:37
• Resolved: 01/Mar/18 18:05

Description

Allow SystemPropertiesPropertySource to run with a SecurityManager that rejects system property access. This is similar to LOG4J2-2274.

A security manager can blow up an app like this:

java.lang.ExceptionInInitializerError
	at org.apache.logging.log4j.util.SystemPropertiesPropertySourceSecurityManagerTest.test(SystemPropertiesPropertySourceSecurityManagerTest.java:64)
	...
Caused by: java.lang.SecurityException
	at org.apache.logging.log4j.util.SystemPropertiesPropertySourceSecurityManagerTest$TestSecurityManager.checkPermission(SystemPropertiesPropertySourceSecurityManagerTest.java:49)
	at java.lang.SecurityManager.checkPropertiesAccess(SecurityManager.java:1265)
	at java.lang.System.getProperties(System.java:624)
	at org.apache.logging.log4j.util.SystemPropertiesPropertySource.forEach(SystemPropertiesPropertySource.java:40)
	at org.apache.logging.log4j.util.PropertiesUtil$Environment.reload(PropertiesUtil.java:330)
	at org.apache.logging.log4j.util.PropertiesUtil$Environment.<init>(PropertiesUtil.java:322)
	at org.apache.logging.log4j.util.PropertiesUtil$Environment.<init>(PropertiesUtil.java:310)
	at org.apache.logging.log4j.util.PropertiesUtil.<init>(PropertiesUtil.java:69)
	at org.apache.logging.log4j.util.PropertiesUtil.<clinit>(PropertiesUtil.java:49)
	... 26 more

Issue Links

• relates to: LOG4J2-2274 Allow EnvironmentPropertySource to run with a SecurityManager that rejects environment variable access