You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@logging.apache.org by fr...@apache.org on 2026/08/18 13:03:50 UTC
(logging-log4net) branch master updated (e3246a54 -> 71c038c1)
This is an automated email from the ASF dual-hosted git repository.
FreeAndNil pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/logging-log4net.git
from e3246a54 Merge pull request #306 from apache/Feature/306-aot-calling-assembly
add ecd1b8b9 report the first appender error without log4net.Internal.Debug
add 9f5c9557 contain per-event failures in AdoNetAppender.SendBuffer
add 19fdb4a2 warn when AdoNetAppender executes layout-generated SQL
add 2fb4539f time out writes to stalled TelnetAppender clients
add e80b3810 redact the password when reporting a failed database connection
add 6bc3df34 document that configuration is trusted input
add bd35fe0d add a TransportSecurity option to the MailKit SmtpAppender
add eccb876e escape NUL characters in LocalSyslogAppender messages
add 46582e52 report a RemoteSyslogAppender Identity that would split the record
add 394fd3dc bound regular expression matching in the string match filters
add 86ecb152 flush TextWriterAppender under the appender lock
add 1786b139 keep the impersonated user name when a logging event is fixed
add 287fa9cd document that format strings are trusted developer input
add 9cc34d29 make the release verification scripts fail closed
add 360a1026 fix the lifetime of the LocalSyslogAppender identity
add 3fd97cb5 bound the waits for the file locking mutexes
add 15d16eed add a listen address to TelnetAppender
add 28d411a5 pin the Maven wrapper and distribution downloads
add e203b7c7 remove the git-broadcast workflow
add dc17e1ba document the conventions the security scan work relied on #309
add 1c664f85 New PR number (#310)
add 843ccfc1 fix AcquireLockGivesUpWhenTheLockIsHeldTooLong on Windows #310
new 71c038c1 Harden log4net against the findings of a security audit
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.github/workflows/git-broadcast.yml | 44 -----
.mvn/wrapper/maven-wrapper.properties | 7 +
AGENTS.md | 24 ++-
CLAUDE.md | 92 +++++++--
scripts/verify-release.ps1 | 78 +++++---
scripts/verify-release.sh | 50 ++++-
src/changelog/3.4.0/310-bound-file-lock-waits.xml | 17 ++
.../3.4.0/310-bound-filter-regex-matching.xml | 17 ++
.../310-contain-per-event-adonet-failures.xml | 15 ++
.../310-escape-nul-in-local-syslog-messages.xml | 14 ++
.../3.4.0/310-flush-uses-the-appender-lock.xml | 15 ++
.../3.4.0/310-pin-maven-wrapper-checksums.xml | 14 ++
...redact-password-in-connection-string-errors.xml | 13 ++
.../3.4.0/310-remove-git-broadcast-workflow.xml | 13 ++
.../310-report-first-appender-error-by-default.xml | 14 ++
.../3.4.0/310-report-malformed-syslog-identity.xml | 15 ++
.../310-require-tls-when-enablessl-is-set.xml | 15 ++
.../3.4.0/310-syslog-identity-lifetime.xml | 15 ++
.../3.4.0/310-telnet-appender-send-timeout.xml | 15 ++
src/changelog/3.4.0/310-telnet-listen-address.xml | 13 ++
.../3.4.0/310-username-honours-the-fix-gate.xml | 16 ++
.../3.4.0/310-verify-release-fails-closed.xml | 16 ++
.../3.4.0/310-warn-about-layout-generated-sql.xml | 13 ++
.../Appender/SmtpAppenderTest.cs | 76 +++++++-
src/log4net.Ext.Mail/Appender/SmtpAppender.cs | 75 +++++--
.../Appender/SmtpTransportSecurity.cs | 79 ++++++++
.../Appender/AdoNet/Log4NetCommand.cs | 58 ++++++
.../Appender/AdoNet/Log4NetConnection.cs | 33 +++-
.../Appender/AdoNet/Log4NetTransaction.cs | 16 +-
src/log4net.Tests/Appender/AdoNetAppenderTest.cs | 156 +++++++++++++++
src/log4net.Tests/Appender/FileAppenderTest.cs | 84 +++++++-
.../Appender/LocalSyslogAppenderTest.cs | 121 ++++++++++++
.../Appender/RemoteSyslogAppenderTest.cs | 71 ++++++-
src/log4net.Tests/Appender/TelnetAppenderTest.cs | 79 ++++++++
.../Appender/TextWriterAppenderTest.cs | 116 +++++++++++
src/log4net.Tests/Core/FixingTest.cs | 99 +++++++++-
src/log4net.Tests/Core/UserNameFixingTest.cs | 43 ++++
src/log4net.Tests/Filter/StringMatchFilterTest.cs | 128 ++++++++++++
src/log4net.Tests/Util/OnlyOnceErrorHandlerTest.cs | 121 ++++++++++++
src/log4net/Appender/AdoNetAppender.cs | 216 ++++++++++++++++++---
src/log4net/Appender/FileAppender.cs | 55 +++++-
src/log4net/Appender/LocalSyslogAppender.cs | 80 ++++++--
src/log4net/Appender/RemoteSyslogAppender.cs | 60 +++++-
src/log4net/Appender/RollingFileAppender.cs | 64 +++++-
src/log4net/Appender/TelnetAppender.cs | 119 +++++++++++-
src/log4net/Appender/TextWriterAppender.cs | 25 ++-
src/log4net/Config/XmlConfigurator.cs | 18 ++
src/log4net/Core/LoggingEvent.cs | 68 ++++++-
src/log4net/Filter/PropertyFilter.cs | 2 +-
src/log4net/Filter/StringMatchFilter.cs | 87 ++++++++-
.../Hierarchy/XmlHierarchyConfigurator.cs | 5 +
src/log4net/Util/OnlyOnceErrorHandler.cs | 9 +-
src/log4net/Util/SystemStringFormat.cs | 5 +-
src/site/antora/modules/ROOT/nav.adoc | 1 +
.../ROOT/pages/manual/configuration/appenders.adoc | 3 +-
.../configuration/appenders/adonetappender.adoc | 14 +-
.../configuration/appenders/fileappender.adoc | 34 +++-
.../configuration/appenders/smtpappender.adoc | 58 +++++-
.../configuration/appenders/telnetappender.adoc | 98 ++++++++++
.../ROOT/pages/manual/configuration/filters.adoc | 23 +++
60 files changed, 2746 insertions(+), 198 deletions(-)
delete mode 100644 .github/workflows/git-broadcast.yml
create mode 100644 src/changelog/3.4.0/310-bound-file-lock-waits.xml
create mode 100644 src/changelog/3.4.0/310-bound-filter-regex-matching.xml
create mode 100644 src/changelog/3.4.0/310-contain-per-event-adonet-failures.xml
create mode 100644 src/changelog/3.4.0/310-escape-nul-in-local-syslog-messages.xml
create mode 100644 src/changelog/3.4.0/310-flush-uses-the-appender-lock.xml
create mode 100644 src/changelog/3.4.0/310-pin-maven-wrapper-checksums.xml
create mode 100644 src/changelog/3.4.0/310-redact-password-in-connection-string-errors.xml
create mode 100644 src/changelog/3.4.0/310-remove-git-broadcast-workflow.xml
create mode 100644 src/changelog/3.4.0/310-report-first-appender-error-by-default.xml
create mode 100644 src/changelog/3.4.0/310-report-malformed-syslog-identity.xml
create mode 100644 src/changelog/3.4.0/310-require-tls-when-enablessl-is-set.xml
create mode 100644 src/changelog/3.4.0/310-syslog-identity-lifetime.xml
create mode 100644 src/changelog/3.4.0/310-telnet-appender-send-timeout.xml
create mode 100644 src/changelog/3.4.0/310-telnet-listen-address.xml
create mode 100644 src/changelog/3.4.0/310-username-honours-the-fix-gate.xml
create mode 100644 src/changelog/3.4.0/310-verify-release-fails-closed.xml
create mode 100644 src/changelog/3.4.0/310-warn-about-layout-generated-sql.xml
create mode 100644 src/log4net.Ext.Mail/Appender/SmtpTransportSecurity.cs
create mode 100644 src/log4net.Tests/Appender/LocalSyslogAppenderTest.cs
create mode 100644 src/log4net.Tests/Appender/TextWriterAppenderTest.cs
create mode 100644 src/log4net.Tests/Filter/StringMatchFilterTest.cs
create mode 100644 src/log4net.Tests/Util/OnlyOnceErrorHandlerTest.cs
create mode 100644 src/site/antora/modules/ROOT/pages/manual/configuration/appenders/telnetappender.adoc
(logging-log4net) 01/01: Harden log4net against the findings of a security audit
Posted by fr...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
FreeAndNil pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/logging-log4net.git
commit 71c038c1860b331ca944840702d72da53e4cb41f
Merge: e3246a54 843ccfc1
Author: Jan Friedrich <43...@users.noreply.github.com>
AuthorDate: Tue Aug 18 15:03:45 2026 +0200
Harden log4net against the findings of a security audit
Appenders: network and transport
- 2fb4539f time out writes to stalled TelnetAppender clients
- 15d16eed add a listen address to TelnetAppender
- bd35fe0d add a TransportSecurity option to the MailKit SmtpAppender
Appenders: syslog record integrity
- eccb876e escape NUL characters in LocalSyslogAppender messages
- 46582e52 report a RemoteSyslogAppender Identity that would split the record
- 360a1026 fix the lifetime of the LocalSyslogAppender identity
AdoNet appender
- 9f5c9557 contain per-event failures in AdoNetAppender.SendBuffer
- 19fdb4a2 warn when AdoNetAppender executes layout-generated SQL
- e80b3810 redact the password when reporting a failed database connection
Reliability and resource bounds
- 3fd97cb5 bound the waits for the file locking mutexes
- 394fd3dc bound regular expression matching in the string match filters
- 86ecb152 flush TextWriterAppender under the appender lock
- 1786b139 keep the impersonated user name when a logging event is fixed
Diagnostics
- ecd1b8b9 report the first appender error without log4net.Internal.Debug
Build and release infrastructure
- 9cc34d29 make the release verification scripts fail closed
- 28d411a5 pin the Maven wrapper and distribution downloads
- e203b7c7 remove the git-broadcast workflow
Documentation
- 6bc3df34 document that configuration is trusted input
- 287fa9cd document that format strings are trusted developer input
- dc17e1ba document the conventions the security scan work relied on (#309)
Notes for reviewers
Several commits introduce secure defaults with a named opt-out (SendTimeoutMillis, MatchTimeoutMillis, LockTimeoutMillis); those are behaviour changes on upgrade and are recorded in the changelog. The documentation commits deliberately settle recurring reports in the threat model rather than changing code.
.github/workflows/git-broadcast.yml | 44 -----
.mvn/wrapper/maven-wrapper.properties | 7 +
AGENTS.md | 24 ++-
CLAUDE.md | 92 +++++++--
scripts/verify-release.ps1 | 78 +++++---
scripts/verify-release.sh | 50 ++++-
src/changelog/3.4.0/310-bound-file-lock-waits.xml | 17 ++
.../3.4.0/310-bound-filter-regex-matching.xml | 17 ++
.../310-contain-per-event-adonet-failures.xml | 15 ++
.../310-escape-nul-in-local-syslog-messages.xml | 14 ++
.../3.4.0/310-flush-uses-the-appender-lock.xml | 15 ++
.../3.4.0/310-pin-maven-wrapper-checksums.xml | 14 ++
...redact-password-in-connection-string-errors.xml | 13 ++
.../3.4.0/310-remove-git-broadcast-workflow.xml | 13 ++
.../310-report-first-appender-error-by-default.xml | 14 ++
.../3.4.0/310-report-malformed-syslog-identity.xml | 15 ++
.../310-require-tls-when-enablessl-is-set.xml | 15 ++
.../3.4.0/310-syslog-identity-lifetime.xml | 15 ++
.../3.4.0/310-telnet-appender-send-timeout.xml | 15 ++
src/changelog/3.4.0/310-telnet-listen-address.xml | 13 ++
.../3.4.0/310-username-honours-the-fix-gate.xml | 16 ++
.../3.4.0/310-verify-release-fails-closed.xml | 16 ++
.../3.4.0/310-warn-about-layout-generated-sql.xml | 13 ++
.../Appender/SmtpAppenderTest.cs | 76 +++++++-
src/log4net.Ext.Mail/Appender/SmtpAppender.cs | 75 +++++--
.../Appender/SmtpTransportSecurity.cs | 79 ++++++++
.../Appender/AdoNet/Log4NetCommand.cs | 58 ++++++
.../Appender/AdoNet/Log4NetConnection.cs | 33 +++-
.../Appender/AdoNet/Log4NetTransaction.cs | 16 +-
src/log4net.Tests/Appender/AdoNetAppenderTest.cs | 156 +++++++++++++++
src/log4net.Tests/Appender/FileAppenderTest.cs | 84 +++++++-
.../Appender/LocalSyslogAppenderTest.cs | 121 ++++++++++++
.../Appender/RemoteSyslogAppenderTest.cs | 71 ++++++-
src/log4net.Tests/Appender/TelnetAppenderTest.cs | 79 ++++++++
.../Appender/TextWriterAppenderTest.cs | 116 +++++++++++
src/log4net.Tests/Core/FixingTest.cs | 99 +++++++++-
src/log4net.Tests/Core/UserNameFixingTest.cs | 43 ++++
src/log4net.Tests/Filter/StringMatchFilterTest.cs | 128 ++++++++++++
src/log4net.Tests/Util/OnlyOnceErrorHandlerTest.cs | 121 ++++++++++++
src/log4net/Appender/AdoNetAppender.cs | 216 ++++++++++++++++++---
src/log4net/Appender/FileAppender.cs | 55 +++++-
src/log4net/Appender/LocalSyslogAppender.cs | 80 ++++++--
src/log4net/Appender/RemoteSyslogAppender.cs | 60 +++++-
src/log4net/Appender/RollingFileAppender.cs | 64 +++++-
src/log4net/Appender/TelnetAppender.cs | 119 +++++++++++-
src/log4net/Appender/TextWriterAppender.cs | 25 ++-
src/log4net/Config/XmlConfigurator.cs | 18 ++
src/log4net/Core/LoggingEvent.cs | 68 ++++++-
src/log4net/Filter/PropertyFilter.cs | 2 +-
src/log4net/Filter/StringMatchFilter.cs | 87 ++++++++-
.../Hierarchy/XmlHierarchyConfigurator.cs | 5 +
src/log4net/Util/OnlyOnceErrorHandler.cs | 9 +-
src/log4net/Util/SystemStringFormat.cs | 5 +-
src/site/antora/modules/ROOT/nav.adoc | 1 +
.../ROOT/pages/manual/configuration/appenders.adoc | 3 +-
.../configuration/appenders/adonetappender.adoc | 14 +-
.../configuration/appenders/fileappender.adoc | 34 +++-
.../configuration/appenders/smtpappender.adoc | 58 +++++-
.../configuration/appenders/telnetappender.adoc | 98 ++++++++++
.../ROOT/pages/manual/configuration/filters.adoc | 23 +++
60 files changed, 2746 insertions(+), 198 deletions(-)