You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nifi.apache.org by jo...@apache.org on 2021/12/20 17:02:36 UTC
[nifi] branch main updated: NIFI-9483 This closes #5616. Excluded Log4j 2 log4j-core and related libraries
This is an automated email from the ASF dual-hosted git repository.
joewitt pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/nifi.git
The following commit(s) were added to refs/heads/main by this push:
new 9dd6b5f NIFI-9483 This closes #5616. Excluded Log4j 2 log4j-core and related libraries
9dd6b5f is described below
commit 9dd6b5f3e5fb7b2cfeab3a9b174132344a17db85
Author: exceptionfactory <ex...@apache.org>
AuthorDate: Sat Dec 18 18:23:31 2021 -0600
NIFI-9483 This closes #5616. Excluded Log4j 2 log4j-core and related libraries
- Added log4j-core to list of banned dependencies
- Added log4j-to-slf4j for Elasticsearch 5 processors to support runtime logging
Signed-off-by: Joe Witt <jo...@apache.org>
---
.../nifi-atlas-reporting-task/pom.xml | 11 +++++++++
.../nifi-druid-controller-service-api/pom.xml | 23 +++++++++++++++++++
.../nifi-elasticsearch-5-processors/pom.xml | 3 ++-
.../nifi-hive-bundle/nifi-hive3-processors/pom.xml | 26 ++++++++++++++++++++++
.../nifi-ignite-processors/pom.xml | 2 +-
.../nifi-ranger-bundle/nifi-ranger-plugin/pom.xml | 9 ++++++++
.../nifi-solr-bundle/nifi-solr-processors/pom.xml | 8 +++++++
.../nifi-registry-ranger-plugin/pom.xml | 9 ++++++++
pom.xml | 4 ++--
9 files changed, 91 insertions(+), 4 deletions(-)
diff --git a/nifi-nar-bundles/nifi-atlas-bundle/nifi-atlas-reporting-task/pom.xml b/nifi-nar-bundles/nifi-atlas-bundle/nifi-atlas-reporting-task/pom.xml
index 5abaa5c..4de76db 100644
--- a/nifi-nar-bundles/nifi-atlas-bundle/nifi-atlas-reporting-task/pom.xml
+++ b/nifi-nar-bundles/nifi-atlas-bundle/nifi-atlas-reporting-task/pom.xml
@@ -78,6 +78,17 @@
<dependency>
<groupId>org.apache.atlas</groupId>
<artifactId>atlas-notification</artifactId>
+ <exclusions>
+ <!-- Exclude Log4j 2 only referenced in optional FailedMessagesLogger -->
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-core</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-api</artifactId>
+ </exclusion>
+ </exclusions>
</dependency>
<dependency>
diff --git a/nifi-nar-bundles/nifi-druid-bundle/nifi-druid-controller-service-api/pom.xml b/nifi-nar-bundles/nifi-druid-bundle/nifi-druid-controller-service-api/pom.xml
index eceddf4..a581a38 100644
--- a/nifi-nar-bundles/nifi-druid-bundle/nifi-druid-controller-service-api/pom.xml
+++ b/nifi-nar-bundles/nifi-druid-bundle/nifi-druid-controller-service-api/pom.xml
@@ -54,6 +54,29 @@
<groupId>io.druid</groupId>
<artifactId>druid-processing</artifactId>
<version>${druid.version}</version>
+ <exclusions>
+ <!-- Exclude Log4j 2 libraries since Druid common Logger uses SLF4J -->
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-api</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-core</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-slf4j-impl</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-jul</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-1.2-api</artifactId>
+ </exclusion>
+ </exclusions>
</dependency>
<dependency>
<groupId>com.github.stephenc.findbugs</groupId>
diff --git a/nifi-nar-bundles/nifi-elasticsearch-bundle/nifi-elasticsearch-5-processors/pom.xml b/nifi-nar-bundles/nifi-elasticsearch-bundle/nifi-elasticsearch-5-processors/pom.xml
index b7ea053..d98b33d 100644
--- a/nifi-nar-bundles/nifi-elasticsearch-bundle/nifi-elasticsearch-5-processors/pom.xml
+++ b/nifi-nar-bundles/nifi-elasticsearch-bundle/nifi-elasticsearch-5-processors/pom.xml
@@ -77,13 +77,14 @@ language governing permissions and limitations under the License. -->
<groupId>org.slf4j</groupId>
<artifactId>jcl-over-slf4j</artifactId>
</dependency>
+ <!-- Route Elasticsearch Log4j 2 logging to SLF4J -->
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
- <artifactId>log4j-core</artifactId>
+ <artifactId>log4j-to-slf4j</artifactId>
</dependency>
<dependency>
<groupId>org.apache.nifi</groupId>
diff --git a/nifi-nar-bundles/nifi-hive-bundle/nifi-hive3-processors/pom.xml b/nifi-nar-bundles/nifi-hive-bundle/nifi-hive3-processors/pom.xml
index 5a3563c..7160e49 100644
--- a/nifi-nar-bundles/nifi-hive-bundle/nifi-hive3-processors/pom.xml
+++ b/nifi-nar-bundles/nifi-hive-bundle/nifi-hive3-processors/pom.xml
@@ -99,6 +99,19 @@
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
</exclusion>
+ <!-- Exclude Log4j 2 since Hive 3 uses SLF4J in component classes -->
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-1.2-api</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-web</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-slf4j-impl</artifactId>
+ </exclusion>
</exclusions>
</dependency>
<dependency>
@@ -112,9 +125,22 @@
<artifactId>log4j</artifactId>
</exclusion>
<exclusion>
+ <groupId>org.slf4j</groupId>
+ <artifactId>slf4j-log4j12</artifactId>
+ </exclusion>
+ <exclusion>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
</exclusion>
+ <!-- Exclude Log4j 2 since Hive 3 uses SLF4J in component classes -->
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-1.2-api</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-slf4j-impl</artifactId>
+ </exclusion>
</exclusions>
</dependency>
diff --git a/nifi-nar-bundles/nifi-ignite-bundle/nifi-ignite-processors/pom.xml b/nifi-nar-bundles/nifi-ignite-bundle/nifi-ignite-processors/pom.xml
index fb2bd1d..d4f795b 100644
--- a/nifi-nar-bundles/nifi-ignite-bundle/nifi-ignite-processors/pom.xml
+++ b/nifi-nar-bundles/nifi-ignite-bundle/nifi-ignite-processors/pom.xml
@@ -48,7 +48,7 @@
</dependency>
<dependency>
<groupId>org.apache.ignite</groupId>
- <artifactId>ignite-log4j2</artifactId>
+ <artifactId>ignite-slf4j</artifactId>
<version>1.6.0</version>
<scope>test</scope>
</dependency>
diff --git a/nifi-nar-bundles/nifi-ranger-bundle/nifi-ranger-plugin/pom.xml b/nifi-nar-bundles/nifi-ranger-bundle/nifi-ranger-plugin/pom.xml
index fb0dca5..0f86e31 100644
--- a/nifi-nar-bundles/nifi-ranger-bundle/nifi-ranger-plugin/pom.xml
+++ b/nifi-nar-bundles/nifi-ranger-bundle/nifi-ranger-plugin/pom.xml
@@ -84,6 +84,15 @@
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
</exclusion>
+ <!-- Exclude Log4j 2 since Ranger does not include direct references to Log4j Loggers -->
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-api</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-core</artifactId>
+ </exclusion>
</exclusions>
</dependency>
<dependency>
diff --git a/nifi-nar-bundles/nifi-solr-bundle/nifi-solr-processors/pom.xml b/nifi-nar-bundles/nifi-solr-bundle/nifi-solr-processors/pom.xml
index ce64e7d..5fcd012 100755
--- a/nifi-nar-bundles/nifi-solr-bundle/nifi-solr-processors/pom.xml
+++ b/nifi-nar-bundles/nifi-solr-bundle/nifi-solr-processors/pom.xml
@@ -123,6 +123,14 @@
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
</exclusion>
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-core</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-slf4j-impl</artifactId>
+ </exclusion>
</exclusions>
<scope>test</scope>
</dependency>
diff --git a/nifi-registry/nifi-registry-extensions/nifi-registry-ranger/nifi-registry-ranger-plugin/pom.xml b/nifi-registry/nifi-registry-extensions/nifi-registry-ranger/nifi-registry-ranger-plugin/pom.xml
index 1af34f0..5891c8e 100644
--- a/nifi-registry/nifi-registry-extensions/nifi-registry-ranger/nifi-registry-ranger-plugin/pom.xml
+++ b/nifi-registry/nifi-registry-extensions/nifi-registry-ranger/nifi-registry-ranger-plugin/pom.xml
@@ -127,6 +127,15 @@
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
</exclusion>
+ <!-- Exclude Log4j 2 since Ranger does not include direct references to Log4j Loggers -->
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-api</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-core</artifactId>
+ </exclusion>
</exclusions>
</dependency>
<dependency>
diff --git a/pom.xml b/pom.xml
index e447221..c3048c5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -795,8 +795,8 @@
<exclude>com.google.code.findbugs:jsr305:*:*:compile</exclude>
<!-- Log4J excluded in favor of log4j-over-slf4j and logback -->
<exclude>log4j:log4j:*</exclude>
- <!-- Ban log4j-core less than 2.17.0 due to multiple vulnerability -->
- <exclude>org.apache.logging.log4j:log4j-core:(,2.17.0)</exclude>
+ <!-- Log4j 2 log4j-core excluded in favor of log4j-to-slf4j routing to logback -->
+ <exclude>org.apache.logging.log4j:log4j-core:*</exclude>
<!-- Commons Logging excluded in favor of jcl-over-slf4j -->
<exclude>commons-logging:commons-logging:*</exclude>
</excludes>