We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SimpleMessage
ReusableSimpleMessage
SimpleMessage可以阻止log4j对输出内容进行参数求解 考虑到Mirai在使用log4j时从来没有使用参数求解的特性 可以传递SimpleMessage停用参数求解,这可以规避不必要的错误,并修复潜在的远程执行漏洞(#1724)
The text was updated successfully, but these errors were encountered:
这不属于 mirai应该做的事情,只需要更新 log4j 版本,或者不使用 log4j core 就行。
mirai 只使用 log4j-api 并且默认使用 mirai 自己的实现(MiraiLogger),不会有日志相关问题;如果用户选择使用 log4j 接管 mirai 日志系统,那么用户需要承担该决策引入的 log4j core 可能导致的安全问题。
Sorry, something went wrong.
Log4jLoggerAdapter被实现在 Mirai 内部,而目前的实现有将完全不需要参数求解的log(这是MiraiLogger的语义)传递给log4j参数求解器的隐患
Log4jLoggerAdapter
这个确实是一个问题,但它的解决方式还有待讨论。
No branches or pull requests
SimpleMessage
可以阻止log4j对输出内容进行参数求解考虑到Mirai在使用log4j时从来没有使用参数求解的特性
可以传递
SimpleMessage
停用参数求解,这可以规避不必要的错误,并修复潜在的远程执行漏洞(#1724)The text was updated successfully, but these errors were encountered: