- slf4j-dev - mailman3.qos.ch

[JIRA] (SLF4J-428) automatic module name for jul-to-slf4j contains illegal token
by QOS.CH (JIRA) 18 Feb '19

18 Feb '19

[ https://jira.qos.ch/browse/SLF4J-428?page=com.atlassian.jira.plugin.system.… ] Gili commented on SLF4J-428: ---------------------------- Ceki, Are you going to use hyphen instead of underscore in the end? The updated version of maven-javadoc-plugin is ready for testing: 3.1.0-SNAPSHOT. Can you test that and let us know if you have any problems? I believe that a release is imminent. > automatic module name for jul-to-slf4j contains illegal token > ------------------------------------------------------------- > > Key: SLF4J-428 > URL: https://jira.qos.ch/browse/SLF4J-428 > Project: SLF4J > Issue Type: Bug > Components: jul-to-slf4j > Affects Versions: 1.8.0-beta1 > Reporter: Peter-Josef Meisch > Assignee: Ceki Gülcü > Fix For: 1.7.26, 1.8.0-beta4 > > Attachments: jpms-testcase.zip > > > the automatic module name that is created in Java 9 for the jul-to-slf4 jar is _jul.to.slf4j(a)1.8.0-beta1_. This contains the token *to* which is a reserved word in Java 9 so the generated name cannot be used in requires statements in modul-info.java files of projects using jul-to-slf4j and inhibits migration of projects to Java 9. > This should be modified by adding > {{Automatic-Module-Name: jul_to_slf4j}} > to the manifest for the archive. -- This message was sent by Atlassian JIRA (v7.3.1#73012)

1 0

JDK 12: First Release Candidate available
by Rory O'Donnell 18 Feb '19

18 Feb '19

Hi Ceki, **OpenJDK builds *- JDK 12 Early Access build 32 **is now available **at : - jdk.java.net/12/* **JDK 12: First Release Candidate [1]** * Per the JDK 12 schedule [2], we are now in Release Candidate Phase. * The stabilization repository, jdk/jdk12, is open for P1 bug fixes per the JDK Release Process (JEP 3) [3]. * All changes require approval via the Fix-Request Process [4]. * Release note additions since last email o Build 31 - can_pop_frame and can_force_early_return capabilities are disabled if JVMCI compiler is used (JDK-8218025 <https://bugs.openjdk.java.net/browse/JDK-8218025>) The JVMTI |can_pop_frame| and |can_force_early_return| capabilities are disabled if a JVMCI compiler (like Graal) is used. As a result the corresponding functionality (|PopFrame| and |ForceEarlyReturnXXX| functions) is not available to JVMTI agents. This issue is being fixed via JDK-8218885 <https://bugs.openjdk.java.net/browse/JDK-8218885> [https://bugs.openjdk.java.net/browse/JDK-8218885 <https://bugs.openjdk.java.net/browse/JDK-8218885>]. o Build 28: JDK-8212233 <https://bugs.openjdk.java.net/browse/JDK-8212233> : javadoc fails on jdk12 with "The code being documented uses modules but the packages defined in $URL are in the unnamed module." * Changes in this build. <http://hg.openjdk.java.net/jdk/jdk12/log?rev=reverse%28%22jdk-12%2B31%22%3A…> **OpenJDK builds *- JDK 13 Early Access build 8 is **now available **at : - jdk.java.net/13/* * These early-access, open-source builds are provided under the o GNU General Public License, version 2, with the Classpath Exception <http://openjdk.java.net/legal/gplv2+ce.html>. * Release Notes updates * Build 8 o GraphicsEnvironment.getCenterPoint()/getMaximumWindowBounds() are unified across the platforms (JDK-8214918 <https://bugs.openjdk.java.net/browse/JDK-8214918>) o The experimental FIPS 140 compliant mode has been removed from the SunJSSE provider. (JDK-8217835 <https://bugs.openjdk.java.net/browse/JDK-8217835>) * Build 7 o Change DOM parser to not resolve EntityReference and add Text node with DocumentBuilderFactory.setExpandEntityReferences(false) (JDK-8206132 <https://bugs.openjdk.java.net/browse/JDK-8206132>) * Build 6 o Base64.Encoder and Base64.Decoder methods can throw OutOfMemoryError (JDK-8210583 <https://bugs.openjdk.java.net/browse/JDK-8210583>) * Changes in this build <http://hg.openjdk.java.net/jdk/jdk/log?rev=reverse%28%22jdk-13%2B7%22%3A%3A…> * FOSS Bugs fixed in recent builds o Build 6 : JDK-8216970 <https://bugs.openjdk.java.net/browse/JDK-8216970> : condy causes JVM crash o Build 7: JDK-8215577 <https://bugs.openjdk.java.net/browse/JDK-8215577> : Remove javadoc support for HTML 4 Rgds,Rory [1] https://mail.openjdk.java.net/pipermail/jdk-dev/2019-February/002623.html [2] http://openjdk.java.net/projects/jdk/12/#Schedule [3] http://openjdk.java.net/jeps/3 [4] http://openjdk.java.net/jeps/3#Fix-Request-Process -- Rgds,Rory O'Donnell Quality Engineering Manager Oracle EMEA , Dublin, Ireland

1 0

[JIRA] (SLF4J-424) extend "Logger" with fluent API to simplify logging calls with additional information (via MDC)
by QOS.CH (JIRA) 18 Feb '19

18 Feb '19

[ https://jira.qos.ch/browse/SLF4J-424?page=com.atlassian.jira.plugin.system.… ] Will Sargent commented on SLF4J-424: ------------------------------------ I've implemented much of this with wrappers in terse-logback: [https://github.com/tersesystems/terse-logback/blob/master/example/src/main/…] There's also the godaddy-logger API: [https://github.com/godaddy/godaddy-logger] and slf4j-fluent: https://github.com/ffissore/slf4j-fluent > extend "Logger" with fluent API to simplify logging calls with additional information (via MDC) > ----------------------------------------------------------------------------------------------- > > Key: SLF4J-424 > URL: https://jira.qos.ch/browse/SLF4J-424 > Project: SLF4J > Issue Type: Improvement > Components: Core API > Reporter: Christian Lorenz > Assignee: SLF4J developers list > > Hi, > > In our project we use SLF4J with Logback and logstash-logback-encoder. To use the advantages of ELK (Logstash) we set fields via MDC within the processing flow, but sometimes we also want to create custom fields (by using MDC) just for a single log message. Unfortunately the SLF4J Logger API does not provide a easy way to do that. > > To improve the API I've started implementing a fluent API to log messages. > [https://github.com/jackhammer2k/slf4j/commit/f3e768260b6f109d1f207e43c48e8c…] > > The approach should not affect the performance, but increases readability and extensibility. > The message builder can be extended for other stuff as well, but this is enough for us at least. > > To avoid breaking all existing implementations I changed the module name to "slf4j-api-jdk8" and implemented so far unused methods like "info()" as "default" interface methods. > The idea is to provide that extra package as an alternative for all Java 8 applications that want to replace their "slf4j-api" dependency. Like other libraries provide backwards-compatible versions for old JDKs. Its fully compatible with the whole SLF4J ecosystem. > > The module will be developed in the branch "slf4j-api-jdk8" forever. Thus during a release all modules will be released, master merged and only this module released from the branch as well. > > I would really like to see this extension within SLF4J instead of continuing with an own "extension library" used only internally. > > So far I've implemented just the info() method to show the idea, but if its accepted to be part of official SLF4J I will continue with the implementation. > > Cheers, > Christian -- This message was sent by Atlassian JIRA (v7.3.1#73012)

1 0

[JIRA] (SLF4J-430) Remove org.slf4j.ext.EventData due to security issue
by QOS.CH (JIRA) 16 Feb '19

16 Feb '19

[ https://jira.qos.ch/browse/SLF4J-430?page=com.atlassian.jira.plugin.system.… ] Ceki Gülcü resolved SLF4J-430. ------------------------------ Resolution: Fixed In 1.7.26 and 1.8.0-beta3 > Remove org.slf4j.ext.EventData due to security issue > ----------------------------------------------------- > > Key: SLF4J-430 > URL: https://jira.qos.ch/browse/SLF4J-430 > Project: SLF4J > Issue Type: Bug > Reporter: Ceki Gülcü > Assignee: Ceki Gülcü > Priority: Critical > Fix For: 1.7.26, 1.8.0-beta3 > > -- This message was sent by Atlassian JIRA (v7.3.1#73012)

1 0

[JIRA] (SLF4J-454) Your project qos-ch/slf4j is using buggy third-party libraries [WARNING]
by QOS.CH (JIRA) 16 Feb '19

16 Feb '19

[ https://jira.qos.ch/browse/SLF4J-454?page=com.atlassian.jira.plugin.system.… ] Ceki Gülcü reopened SLF4J-454: ------------------------------ > Your project qos-ch/slf4j is using buggy third-party libraries [WARNING] > ------------------------------------------------------------------------ > > Key: SLF4J-454 > URL: https://jira.qos.ch/browse/SLF4J-454 > Project: SLF4J > Issue Type: Bug > Environment: Hi, there! > We are a research team working on third-party library analysis. We have found that some widely-used third-party libraries in your project have major/critical bugs, which will degrade the quality of your project. We highly recommend you to update those libraries to new versions. > We have attached the buggy third-party libraries and corresponding jira issue links below for you to have more detailed information. > 1. commons-lang commons-lang > version: 2.4 > Jira issues: > Fix case-insensitive string handling > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-432?filter=allopen… > StringEscapeUtils.escapeHTML() does not escape chars (0x00-0x20) > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-439?filter=allopen… > DateUtils.round doesn't work correct for Calendar.AM_PM > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-440?filter=allopen… > Lower Ascii Characters don't get encoded by Entities.java > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-448?filter=allopen… > Issue in HashCodeBuilder which only shows up under high load multi-threaded usage. > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-459?filter=allopen… > Ant build file does not include ReflectTestSuite > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-463?filter=allopen… > EqualsBuilder and HashCodeBuilder treat java.math.BigDecimal inconsistantly and break general contract of hashCode > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-467?filter=allopen… > JDK 1.5 build/runtime failure on LANG-393 (EqualsBuilder) > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-468?filter=allopen… > ExtendedMessageFormat: OutOfMemory with custom format registry and a pattern containing single quotes > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-477?filter=allopen… > parseDate cannot parse ISO8601 dates produced by FastDateFormat > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-530?filter=allopen… > DateFormatUtils.format does not correctly change Calendar TimeZone in certain situations > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-538?filter=allopen… > StringUtils replaceEach - Bug or Missing Documentation > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-552?filter=allopen… > Javadoc wrong for StringUtils startsWith; startsWithIgnoreCase; endsWith and endsWithIgnoreCase > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-557?filter=allopen… > HashCodeBuilder reflectionAppend creates unnecessary copy of excludeFields > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-575?filter=allopen… > ExceptionUtils uses mutable lock target > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-584?filter=allopen… > ClassUtils.toClass(Object[]) throws NPE on null array element > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-587?filter=allopen… > > Sincerely~ > FDU Software Engineering Lab > Feb 15th, 2019 > Reporter: Kaifeng Huang > Assignee: SLF4J developers list > Fix For: 1.8.0-beta4 > > -- This message was sent by Atlassian JIRA (v7.3.1#73012)

1 0

[JIRA] (SLF4J-454) Your project qos-ch/slf4j is using buggy third-party libraries [WARNING]
by QOS.CH (JIRA) 16 Feb '19

16 Feb '19

[ https://jira.qos.ch/browse/SLF4J-454?page=com.atlassian.jira.plugin.system.… ] Ceki Gülcü resolved SLF4J-454. ------------------------------ Resolution: Fixed Fixed by removing EventData EventException EventLogger classes in the org.slf4j.ext package in the slf4j-ext module. These classes were rarely used. > Your project qos-ch/slf4j is using buggy third-party libraries [WARNING] > ------------------------------------------------------------------------ > > Key: SLF4J-454 > URL: https://jira.qos.ch/browse/SLF4J-454 > Project: SLF4J > Issue Type: Bug > Environment: Hi, there! > We are a research team working on third-party library analysis. We have found that some widely-used third-party libraries in your project have major/critical bugs, which will degrade the quality of your project. We highly recommend you to update those libraries to new versions. > We have attached the buggy third-party libraries and corresponding jira issue links below for you to have more detailed information. > 1. commons-lang commons-lang > version: 2.4 > Jira issues: > Fix case-insensitive string handling > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-432?filter=allopen… > StringEscapeUtils.escapeHTML() does not escape chars (0x00-0x20) > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-439?filter=allopen… > DateUtils.round doesn't work correct for Calendar.AM_PM > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-440?filter=allopen… > Lower Ascii Characters don't get encoded by Entities.java > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-448?filter=allopen… > Issue in HashCodeBuilder which only shows up under high load multi-threaded usage. > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-459?filter=allopen… > Ant build file does not include ReflectTestSuite > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-463?filter=allopen… > EqualsBuilder and HashCodeBuilder treat java.math.BigDecimal inconsistantly and break general contract of hashCode > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-467?filter=allopen… > JDK 1.5 build/runtime failure on LANG-393 (EqualsBuilder) > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-468?filter=allopen… > ExtendedMessageFormat: OutOfMemory with custom format registry and a pattern containing single quotes > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-477?filter=allopen… > parseDate cannot parse ISO8601 dates produced by FastDateFormat > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-530?filter=allopen… > DateFormatUtils.format does not correctly change Calendar TimeZone in certain situations > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-538?filter=allopen… > StringUtils replaceEach - Bug or Missing Documentation > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-552?filter=allopen… > Javadoc wrong for StringUtils startsWith; startsWithIgnoreCase; endsWith and endsWithIgnoreCase > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-557?filter=allopen… > HashCodeBuilder reflectionAppend creates unnecessary copy of excludeFields > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-575?filter=allopen… > ExceptionUtils uses mutable lock target > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-584?filter=allopen… > ClassUtils.toClass(Object[]) throws NPE on null array element > affectsVersions:2.4 > https://issues.apache.org/jira/projects/LANG/issues/LANG-587?filter=allopen… > > Sincerely~ > FDU Software Engineering Lab > Feb 15th, 2019 > Reporter: Kaifeng Huang > Assignee: SLF4J developers list > Fix For: 1.7.26, 1.8.0-beta3 > > -- This message was sent by Atlassian JIRA (v7.3.1#73012)

1 0

[JIRA] (SLF4J-455) Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete...
by QOS.CH (JIRA) 16 Feb '19

16 Feb '19

Neustradamus created SLF4J-455: ---------------------------------- Summary: Missing 1.8.0 stable build, no CVEs patches... beta-2 not complete... Key: SLF4J-455 URL: https://jira.qos.ch/browse/SLF4J-455 Project: SLF4J Issue Type: Bug Components: Core API, slf4j-ext Affects Versions: 1.8.0-beta2, 1.7.25, 1.8.0-beta3 Environment: all Reporter: Neustradamus Assignee: SLF4J developers list There are CVEs but no stable version with patchs. There is a 1.8.0-beta2 which is not perfect (2018-03-21) and a 1.8.0-beta3 not published. -> [http://mailman.qos.ch/pipermail/slf4j-user/2019-February/001700.html] -> [http://mailman.qos.ch/pipermail/slf4j-dev/2019-February/005115.html] A lot of softwares use slf4j 1.7.25 but not with CVEs patchs because no new stable version, why? Can you release a stable version with CVEs patches? Soon one year after... -- This message was sent by Atlassian JIRA (v7.3.1#73012)

1 0

[JIRA] (SLF4J-454) Your project qos-ch/slf4j is using buggy third-party libraries [WARNING]
by QOS.CH (JIRA) 15 Feb '19

15 Feb '19

Kaifeng Huang created SLF4J-454: ----------------------------------- Summary: Your project qos-ch/slf4j is using buggy third-party libraries [WARNING] Key: SLF4J-454 URL: https://jira.qos.ch/browse/SLF4J-454 Project: SLF4J Issue Type: Bug Environment: Hi, there! We are a research team working on third-party library analysis. We have found that some widely-used third-party libraries in your project have major/critical bugs, which will degrade the quality of your project. We highly recommend you to update those libraries to new versions. We have attached the buggy third-party libraries and corresponding jira issue links below for you to have more detailed information. 1. commons-lang commons-lang version: 2.4 Jira issues: Fix case-insensitive string handling affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-432?filter=allopen… StringEscapeUtils.escapeHTML() does not escape chars (0x00-0x20) affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-439?filter=allopen… DateUtils.round doesn't work correct for Calendar.AM_PM affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-440?filter=allopen… Lower Ascii Characters don't get encoded by Entities.java affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-448?filter=allopen… Issue in HashCodeBuilder which only shows up under high load multi-threaded usage. affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-459?filter=allopen… Ant build file does not include ReflectTestSuite affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-463?filter=allopen… EqualsBuilder and HashCodeBuilder treat java.math.BigDecimal inconsistantly and break general contract of hashCode affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-467?filter=allopen… JDK 1.5 build/runtime failure on LANG-393 (EqualsBuilder) affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-468?filter=allopen… ExtendedMessageFormat: OutOfMemory with custom format registry and a pattern containing single quotes affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-477?filter=allopen… parseDate cannot parse ISO8601 dates produced by FastDateFormat affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-530?filter=allopen… DateFormatUtils.format does not correctly change Calendar TimeZone in certain situations affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-538?filter=allopen… StringUtils replaceEach - Bug or Missing Documentation affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-552?filter=allopen… Javadoc wrong for StringUtils startsWith; startsWithIgnoreCase; endsWith and endsWithIgnoreCase affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-557?filter=allopen… HashCodeBuilder reflectionAppend creates unnecessary copy of excludeFields affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-575?filter=allopen… ExceptionUtils uses mutable lock target affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-584?filter=allopen… ClassUtils.toClass(Object[]) throws NPE on null array element affectsVersions:2.4 https://issues.apache.org/jira/projects/LANG/issues/LANG-587?filter=allopen… Sincerely~ FDU Software Engineering Lab Feb 15th, 2019 Reporter: Kaifeng Huang Assignee: SLF4J developers list -- This message was sent by Atlassian JIRA (v7.3.1#73012)

2 1

SLF4J CVE stable solution
by - Neustradamus - 11 Feb '19

11 Feb '19

Dear all, It is possible to have an official stable 1.8.0 of slf4j with CVEs solution? -> https://www.cvedetails.com/vulnerability-list/vendor_id-17827/Slf4j.html There is only a beta2 from one year... -> https://www.slf4j.org/news.html -> https://www.slf4j.org/download.html -> https://github.com/qos-ch/slf4j/releases And there is a problem: Softwares do not used unstable builds. Thanks in advance. Regards, Neustradamus

1 0

[JIRA] (SLF4J-451) org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data.
by QOS.CH (JIRA) 05 Feb '19

05 Feb '19

[ https://jira.qos.ch/browse/SLF4J-451?page=com.atlassian.jira.plugin.system.… ] Kevin Wilson commented on SLF4J-451: ------------------------------------ >> It is irrelevent whether the vulnerability is really neither critical nor severe. Agreed!!! Very nice account as to why this bug should be fixed and soon! Also, the primary maintainers need to include vulnerability scanning in their build pipeline to catch things like this before they are committed. The open source tools to have your code scanned on every build exists and are quite good, you simply have to use them. > org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. > ------------------------------------------------------------------------------------------------------------------------------------------------------------------- > > Key: SLF4J-451 > URL: https://jira.qos.ch/browse/SLF4J-451 > Project: SLF4J > Issue Type: Bug > Components: slf4j-ext > Affects Versions: 1.8.0-beta2 > Environment: Linux > Reporter: Narayan > Assignee: SLF4J developers list > Labels: logging > > More details is available in [https://nvd.nist.gov/vuln/detail/CVE-2018-8088|https://nvd.nist.gov/vuln/de…] -- This message was sent by Atlassian JIRA (v7.3.1#73012)

1 0