January 2022 - logback-dev - mailman3.qos.ch

[JIRA] (LOGBACK-1575) Replace old servlet-api with jakarta servlet-api in logback-access
by QOS.CH (JIRA) 06 Jan '22

06 Jan '22

1 0

[JIRA] Updates for LOGBACK-1609: Bring back DBAppender or document how to proceed without it
by QOS.CH (JIRA) 06 Jan '22

06 Jan '22

logback / LOGBACK-1609 [Open] Bring back DBAppender or document how to proceed without it ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/LOGBACK-1609 ============================== Issue created ------------------------------ Benedict Roeser created this issue on 06/Jan/22 2:45 PM Summary: Bring back DBAppender or document how to proceed without it Issue Type: Bug Affects Versions: 1.2.9 Assignee: Logback dev list Components: logback-classic Created: 06/Jan/22 2:45 PM Priority: Major Reporter: Benedict Roeser Description: In the last minor version, 1.2.9, the DBAppender was removed (ch.qos.logback.classic.db.DBAppender). This was something which we used in our project. I could not find a ticket or any documentation for a possible replacement / how to upgrade applications using the DBAppender properly. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] Updates for LOGBACK-1608: Bring back JDBC DBAppender
by QOS.CH (JIRA) 06 Jan '22

06 Jan '22

logback / LOGBACK-1608 [Open] Bring back JDBC DBAppender ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/LOGBACK-1608 ============================== Issue created ------------------------------ Steven Davies created this issue on 06/Jan/22 11:03 AM Summary: Bring back JDBC DBAppender Issue Type: Improvement Affects Versions: 1.2.9 Assignee: Logback dev list Created: 06/Jan/22 11:03 AM Priority: Critical Reporter: Steven Davies Description: LOGBACK-1591 removed the JDBC subsystem. I have a project which uses a custom appender based on this and after updating to Logback 1.2.9 (as a dependency of spring-boot 2.6.2 -> spring-boot-starter-logging) the package ch.qos.logback.core.db has been removed and the project no longer compiles. Can the JDBC code be reintroduced at least as a separate Maven package? ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] (LOGBACK-1606) Bring Back Groovy Config and use SecureASTCustomizer to secure it
by QOS.CH (JIRA) 05 Jan '22

05 Jan '22

1 0

[JIRA] (LOGBACK-1606) Bring Back Groovy Config and use SecureASTCustomizer to secure it
by QOS.CH (JIRA) 05 Jan '22

05 Jan '22

1 0

[JIRA] Updates for LOGBACK-1607: Logback does not honor logback.groovy in 1.2.10
by QOS.CH (JIRA) 05 Jan '22

05 Jan '22

logback / LOGBACK-1607 [Open] Logback does not honor logback.groovy in 1.2.10 ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/LOGBACK-1607 ============================== Issue created ------------------------------ Rahul Somasunderam created this issue on 05/Jan/22 2:00 AM Summary: Logback does not honor logback.groovy in 1.2.10 Issue Type: Bug Affects Versions: 1.2.10 Assignee: Logback dev list Attachments: logback-bug-1.zip Created: 05/Jan/22 2:00 AM Priority: Major Reporter: Rahul Somasunderam Description: I have this logback.groovy {code:java} import ch.qos.logback.classic.filter.ThresholdFilter import static ch.qos.logback.classic.Level.* appender("CONSOLE", ConsoleAppender) { filter(ThresholdFilter) { level = WARN } encoder(PatternLayoutEncoder) { pattern = "%-5level - %msg%n" } target = "System.err" } logger("logback.bug", DEBUG) root(WARN, ["CONSOLE"]) {code} Logback doesn't appear to honor it in 1.2.10. In 1.2.8, it works as expected. Attached is a project that reproduces the bug. Source can be found here - [https://github.com/rahulsom/logback-bug-1] Expected behavior: Both 1.2.8 and 1.2.10 emit this to STDERR {code:java} WARN - Warn ERROR - Error {code} Actual behavior: 1.2.8 does that. 1.2.10 emits nothing to STDERR, but emits this to STDOUT {code:java} 16:55:40.811 [Test worker] INFO logback.bug.MyClass - Info 16:55:40.812 [Test worker] DEBUG logback.bug.MyClass - Debug 16:55:40.812 [Test worker] WARN logback.bug.MyClass - Warn 16:55:40.812 [Test worker] ERROR logback.bug.MyClass - Error {code} ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0

[JIRA] (LOGBACK-1606) Bring Back Groovy Config and use SecureASTCustomizer to secure it
by QOS.CH (JIRA) 04 Jan '22

04 Jan '22

1 0

[JIRA] (LOGBACK-1606) Bring Back Groovy Config and use SecureASTCustomizer to secure it
by QOS.CH (JIRA) 04 Jan '22

04 Jan '22

1 0

[JIRA] (LOGBACK-1606) Bring Back Groovy Config and use SecureASTCustomizer to secure it
by QOS.CH (JIRA) 04 Jan '22

04 Jan '22

1 0

[JIRA] Updates for LOGBACK-1606: Bring Back Groovy Config and use SecureASTCustomizer to secure it
by QOS.CH (JIRA) 04 Jan '22

04 Jan '22

logback / LOGBACK-1606 [Open] Bring Back Groovy Config and use SecureASTCustomizer to secure it ============================== Here's what changed in this issue in the last few minutes. This issue has been created This issue is now assigned to you. View or comment on issue using this link https://jira.qos.ch/browse/LOGBACK-1606 ============================== Issue created ------------------------------ Tucker J Pelletier created this issue on 04/Jan/22 5:31 AM Summary: Bring Back Groovy Config and use SecureASTCustomizer to secure it Issue Type: Improvement Affects Versions: 1.2.9 Assignee: Logback dev list Created: 04/Jan/22 5:31 AM Priority: Blocker Reporter: Tucker J Pelletier Description: There are a lot of apps that use the Groovy-based config(including all Grails apps). To convert these to XML will require a lot of changes and there would be things that are not supported. For example in all the apps I'm currently working in we have a standard setup for the dev environment, but in the production environment, we use an appender for Log Entries. I think it should be the implementer's choice to use Groovy for config or not, and just make the implementer aware of the possible issue. That being said there are steps you can take to lockdown a DSL using the SecureASTCustomizer. The SecureASTCustomizer lets to limit what a user can import, what tokens they can use and you can even create a SecureASTCustomizer.ExpressionChecker would allow you to add an allow list check for method names. I created some sample code at these links: [https://github.com/virtualdogbert/logback-test] [https://github.com/virtualdogbert/logback-test/blob/master/grails-app/init/…] [https://github.com/virtualdogbert/logback-test/blob/master/src/main/groovy/…] [https://github.com/virtualdogbert/logback-test/blob/master/src/main/groovy/…] I would say this is a good start but you would have to actually integrate it with the deleted code and do a fair amount of testing. There may be other imports that other people would want added to the allow list, based on whatever framework they are using, which is something that could be updated/expanded over time, however being security-minded you will probably want to keep the list somewhat short, and concise. Here are some additional links about using the SecureASTCustomizer: [https://docs.groovy-lang.org/latest/html/documentation/#compilation-customi…] [https://blog.mrhaki.com/2014/04/groovy-goodness-restricting-script.html] Let me know your thoughts or if you have any questions. ============================== This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

1 0