[LOG4J2-2578] RequestContextMappings should ignore private and instance fields

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: Log4j-Audit 1.0.1
• Fix Version/s: Log4j-Audit 1.0.2
• Component/s: Log4j-Audit

Environment

Java 11

• Flags: Patch
• Assignee: Unassigned
• Reporter: Andrei Ivanov
• Created: 01/Apr/19 08:58
• Updated: 04/Apr/19 00:16
• Resolved: 04/Apr/19 00:09

Description

RequestContextMappings inspects the user defined class passed as a constructor parameter, but it checks all fields, instead of just the public static ones (at least that's what I understand it should do).

In Java 8 the issue is covered by catching an IllegalAccessException when accessing the field value, but in Java 11 this throws a NullPointerException for non-static fields.

The proposed solution would be to replace clazz.getDeclaredFields() with clazz.getFields(), to obtain only the accessible public fields, and then check them to process only the static ones.

Issue Links

• links to: GitHub Pull Request #18