You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@logging.apache.org by gg...@apache.org on 2016/09/07 02:21:41 UTC
logging-log4j2 git commit: [LOG4J2-1563] Log4j 2.6.2 can lose
exceptions when a security manager is present.
Repository: logging-log4j2
Updated Branches:
refs/heads/master 809010638 -> b7b30013e
[LOG4J2-1563] Log4j 2.6.2 can lose exceptions when a security manager is
present.
Project: http://git-wip-us.apache.org/repos/asf/logging-log4j2/repo
Commit: http://git-wip-us.apache.org/repos/asf/logging-log4j2/commit/b7b30013
Tree: http://git-wip-us.apache.org/repos/asf/logging-log4j2/tree/b7b30013
Diff: http://git-wip-us.apache.org/repos/asf/logging-log4j2/diff/b7b30013
Branch: refs/heads/master
Commit: b7b30013e84e8be2b6bbc8326e9bc2ff27e239f1
Parents: 8090106
Author: Gary Gregory <gg...@apache.org>
Authored: Tue Sep 6 22:21:37 2016 -0400
Committer: Gary Gregory <gg...@apache.org>
Committed: Tue Sep 6 22:21:37 2016 -0400
----------------------------------------------------------------------
.../logging/log4j/core/impl/ThrowableProxy.java | 4 ++
.../log4j/core/impl/ThrowableProxyTest.java | 56 ++++++++++++++++++++
src/changes/changes.xml | 3 ++
3 files changed, 63 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/logging-log4j2/blob/b7b30013/log4j-core/src/main/java/org/apache/logging/log4j/core/impl/ThrowableProxy.java
----------------------------------------------------------------------
diff --git a/log4j-core/src/main/java/org/apache/logging/log4j/core/impl/ThrowableProxy.java b/log4j-core/src/main/java/org/apache/logging/log4j/core/impl/ThrowableProxy.java
index ac93f50..94e2be0 100644
--- a/log4j-core/src/main/java/org/apache/logging/log4j/core/impl/ThrowableProxy.java
+++ b/log4j-core/src/main/java/org/apache/logging/log4j/core/impl/ThrowableProxy.java
@@ -569,6 +569,8 @@ public class ThrowableProxy implements Serializable {
return initializeClass(className);
} catch (final NoClassDefFoundError ignored) {
return initializeClass(className);
+ } catch (final SecurityException ignored) {
+ return null;
}
return clazz;
}
@@ -580,6 +582,8 @@ public class ThrowableProxy implements Serializable {
return null;
} catch (final NoClassDefFoundError ignore) {
return null;
+ } catch (final SecurityException ignore) {
+ return null;
}
}
http://git-wip-us.apache.org/repos/asf/logging-log4j2/blob/b7b30013/log4j-core/src/test/java/org/apache/logging/log4j/core/impl/ThrowableProxyTest.java
----------------------------------------------------------------------
diff --git a/log4j-core/src/test/java/org/apache/logging/log4j/core/impl/ThrowableProxyTest.java b/log4j-core/src/test/java/org/apache/logging/log4j/core/impl/ThrowableProxyTest.java
index 98e3ec7..3bae771 100644
--- a/log4j-core/src/test/java/org/apache/logging/log4j/core/impl/ThrowableProxyTest.java
+++ b/log4j-core/src/test/java/org/apache/logging/log4j/core/impl/ThrowableProxyTest.java
@@ -27,6 +27,14 @@ import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
+import java.net.BindException;
+import java.net.InetSocketAddress;
+import java.net.SocketPermission;
+import java.nio.channels.ServerSocketChannel;
+import java.security.CodeSource;
+import java.security.PermissionCollection;
+import java.security.Permissions;
+import java.security.Policy;
import java.util.HashMap;
import java.util.Map;
import java.util.Stack;
@@ -123,6 +131,54 @@ public class ThrowableProxyTest {
}
}
+ @Test
+ public void testLogStackTraceWithClassThatWillCauseSecurityException() throws IOException {
+ class SimplePolicy extends Policy {
+
+ private final Permissions permissions;
+
+ public SimplePolicy(Permissions permissions) {
+ this.permissions = permissions;
+ }
+
+ @Override
+ public PermissionCollection getPermissions(CodeSource codesource) {
+ return permissions;
+ }
+
+ }
+
+ final SecurityManager sm = System.getSecurityManager();
+ try {
+ final Permissions permissions = new Permissions();
+
+ // you know, for binding
+ permissions.add(new SocketPermission("localhost:9300", "listen,resolve"));
+
+ /**
+ * the JUnit test runner uses reflection to invoke the test; while leaving this
+ * permission out would display the same issue, it's clearer to grant this
+ * permission and show the real issue that would arise
+ */
+ // TODO: other JDKs might need a different permission here
+ permissions.add(new RuntimePermission("accessClassInPackage.sun.reflect"));
+
+ // for restoring the security manager after test execution
+ permissions.add(new RuntimePermission("setSecurityManager"));
+
+ Policy.setPolicy(new SimplePolicy(permissions));
+ System.setSecurityManager(new SecurityManager());
+ ServerSocketChannel.open().socket().bind(new InetSocketAddress("localhost", 9300));
+ ServerSocketChannel.open().socket().bind(new InetSocketAddress("localhost", 9300));
+ fail("expected a java.net.BindException");
+ } catch (final BindException e) {
+ new ThrowableProxy(e);
+ } finally {
+ // restore the security manager
+ System.setSecurityManager(sm);
+ }
+ }
+
// DO NOT REMOVE THIS COMMENT:
// UNCOMMENT WHEN GENERATING SERIALIZED THROWABLEPROXY FOR #testSerializationWithUnknownThrowable
// public static class DeletedException extends Exception {
http://git-wip-us.apache.org/repos/asf/logging-log4j2/blob/b7b30013/src/changes/changes.xml
----------------------------------------------------------------------
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index f6d7ffc..b718b09 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -24,6 +24,9 @@
</properties>
<body>
<release version="2.7" date="2016-MM-DD" description="GA Release 2.7">
+ <action issue="LOG4J2-1563" dev="ggregory" type="fix" due-to="Jason Tedor">
+ Log4j 2.6.2 can lose exceptions when a security manager is present.
+ </action>
<action issue="LOG4J2-1530" dev="mikes" type="fix">
LogEvent.getContextStack() can return null.
</action>