Skip to content

Commit

Permalink
Prevent loading JndiLookup to patch CVE-2021-45046
Browse files Browse the repository at this point in the history
  • Loading branch information
acrylic-style committed Dec 16, 2021
1 parent 215fadb commit 82384f5
Show file tree
Hide file tree
Showing 12 changed files with 15 additions and 817 deletions.
2 changes: 1 addition & 1 deletion pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@

<groupId>net.azisaba</groupId>
<artifactId>Log4j2Fix</artifactId>
<version>1.0.3</version>
<version>1.0.4</version>

<properties>
<maven.compiler.source>8</maven.compiler.source>
Expand Down
21 changes: 14 additions & 7 deletions src/main/java/net/azisaba/log4j2Fix/Log4j2Fix.java
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
import java.util.zip.ZipFile;

public class Log4j2Fix {
private static boolean registered = false;
private static String arg;
private static Instrumentation inst;

Expand Down Expand Up @@ -96,13 +97,14 @@ public static void premain(String args, Instrumentation instrumentation) throws
}

public static void transformClasses() throws IOException {
transformClass("org.apache.logging.log4j.core.appender.mom.JmsAppender", false);
transformClass("org.apache.logging.log4j.core.appender.mom.JmsAppender$1", false);
transformClass("org.apache.logging.log4j.core.appender.mom.JmsAppender$Builder", false);
transformClass("org.apache.logging.log4j.core.net.JndiManager", false);
transformClass("org.apache.logging.log4j.core.net.JndiManager$1", false);
transformClass("org.apache.logging.log4j.core.net.JndiManager$JndiManagerFactory", false);
transformClass("org.apache.logging.log4j.core.util.NetUtils", false);
if (registered) return;
registered = true;
NativeUtil.registerClassLoadHook((classLoader, s, aClass, protectionDomain, bytes) -> {
if ("org/apache/logging/log4j/core/lookup/JndiLookup".equals(s) || s.startsWith("org/apache/logging/log4j/core/lookup/JndiLookup$")) {
sneakyThrow(new ClassNotFoundException());
}
return null;
});
if (Boolean.getBoolean("log4j2Fix.loadReflectionUtil")) {
transformClass("org.apache.logging.log4j.util.ReflectionUtil", true);
transformClass("org.apache.logging.log4j.util.ReflectionUtil$PrivateSecurityManager", true);
Expand Down Expand Up @@ -144,4 +146,9 @@ public static byte[] readAllBytes(InputStream in) throws IOException {
}
return baos.toByteArray();
}

@SuppressWarnings("unchecked")
public static <X extends Throwable> void sneakyThrow(Throwable throwable) throws X {
throw (X) throwable;
}
}
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.

This file was deleted.

Loading

0 comments on commit 82384f5

Please sign in to comment.