[LOG4J2-3541] ThreadContextDataInjector Uses Incorrect Providers Under Tomcat

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.17.1
• Component/s: Core, Web/Servlet

Environment

Tomcat 9.0.58 with the following jars in ${CATALINA_HOME}/lib:

log4j-api-2.17.1.jar

log4j-core-2.17.1.jar

log4j-jul-2.17.1.jar

JUL LogManager is org.apache.logging.log4j.jul.LogManager

• Assignee: Unassigned
• Reporter: Dave Hawkins
• Created: 20/Jun/22 17:25
• Updated: 21/Jun/22 15:27

Description

We are using Log4j with tomcat by including it in the boot classpath and using Log4jServletContextListener in the web.xml. We are also using the log4j JUL LogManager. Web application ContextDataProviders are not being loaded correctly.

I think this is because ThreadContextDataInjector::getServiceProviders is sensitive to the web application classpath, but the class, which is shared between the web applications and tomcat, statically caches the result. The providers list for tomcat is initialized first and is thus incorrectly used for the web applications.