[LOG4J2-3360] Document unsafe lookup usage patterns

• Type: Improvement
• Status: Reopened
• Priority: Major
• Resolution: Unresolved
• Fix Version/s: 2.19.0
• Assignee: Unassigned
• Reporter: Volkan Yazici
• Created: 21/Jan/22 15:16
• Updated: 02/Sep/22 22:40

Description

The recent CVE storm has proven that lookups are employed by users in many places where they shouldn't. In particular, lookups depending on LogEvent's (e.g., ctx) are honey pots for attackers and there are safer ways to expose the very same information via more native constructs, e.g., MDC accessors in PatternLayout and JsonTemplateLayout. This story aims to enrich the lookup and certain layout documentations with such best practices.

Issue Links

• links to: GitHub Pull Request #970