[karaf] branch karaf-4.2.x updated: [KARAF-7061] Change log4j2.pattern to prevent CRLF/HTML code injection

[jb...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

jbonofre pushed a commit to branch karaf-4.2.x
in repository https://gitbox.apache.org/repos/asf/karaf.git


The following commit(s) were added to refs/heads/karaf-4.2.x by this push:
     new 9b60070  [KARAF-7061] Change log4j2.pattern to prevent CRLF/HTML code injection
9b60070 is described below

commit 9b6007026db9399708bc3a43dd7ea95862d621de
Author: jbonofre <jb...@apache.org>
AuthorDate: Fri Mar 5 14:38:13 2021 +0100

    [KARAF-7061] Change log4j2.pattern to prevent CRLF/HTML code injection
    
    (cherry picked from commit bac366abbc27e9961476d303e54fa17820fee765)
---
 .../base/src/main/resources/resources/etc/org.ops4j.pax.logging.cfg     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/assemblies/features/base/src/main/resources/resources/etc/org.ops4j.pax.logging.cfg b/assemblies/features/base/src/main/resources/resources/etc/org.ops4j.pax.logging.cfg
index ddbcae9..4593485 100644
--- a/assemblies/features/base/src/main/resources/resources/etc/org.ops4j.pax.logging.cfg
+++ b/assemblies/features/base/src/main/resources/resources/etc/org.ops4j.pax.logging.cfg
@@ -26,7 +26,7 @@ color.debug = cyan
 color.trace = cyan
 
 # Common pattern layout for appenders
-log4j2.pattern = %d{ISO8601} | %-5p | %-16t | %-32c{1} | %X{bundle.id} - %X{bundle.name} - %X{bundle.version} | %m%n
+log4j2.pattern = %d{ISO8601} | %-5p | %-16t | %-32c{1} | %X{bundle.id} - %X{bundle.name} - %X{bundle.version} | %encode{%.-500m}%n
 log4j2.out.pattern = \u001b[90m%d{HH:mm:ss\.SSS}\u001b[0m %highlight{%-5level}{FATAL=${color.fatal}, ERROR=${color.error}, WARN=${color.warn}, INFO=${color.info}, DEBUG=${color.debug}, TRACE=${color.trace}} \u001b[90m[%t]\u001b[0m %msg%n%throwable