Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fixed the log4j security issues #126

Merged
merged 6 commits into from
Jan 21, 2025

Conversation

arlange
Copy link
Member

@arlange arlange commented Jan 20, 2025

No description provided.

@arlange arlange requested a review from a team as a code owner January 20, 2025 17:57
@arlange arlange linked an issue Jan 20, 2025 that may be closed by this pull request
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file should probably be excluded or do we really need it?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The same applies to the generated code in src-gen, do we really need that in the repo?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Maven build generates all files to the target folder and the remaining steps of the build (e.g., Java compiler) only pick up files from there. We can add the directories to the .gitignore file, but there is really no point in using them, unless the entire build is done by Eclipse.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

xtend-gen should probably also be excluded

checkState(correspondencesResource != null, "Correspondences resource must be specified to load existing correspondences");
Resource loadedResource = loadOrCreateResource(withGlobalFactories(new ResourceSetImpl()), correspondencesResource.getURI());
checkState(correspondencesResource != null,
"Correspondences resource must be specified to load existing correspondences");
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please don't check in formatting changes or use a dedicated PR for them.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wasn't my intention, sorry

@arlange arlange merged commit 982952f into main Jan 21, 2025
8 checks passed
@arlange arlange deleted the 125-deserialization-of-untrusted-data-in-log4j-5 branch January 21, 2025 08:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Deserialization of Untrusted Data in Log4j #5
3 participants