0x00 log4j2
5 Dec 2021 官方commit
LOG4J2-3201 - Limit the protocols JNDI can use by default. Limit the … · apache/logging-log4j2@d82b47c · GitHub
org.apache.logging.log4j.core.net.JndiManager.java :
没有修改前,lookup方法直接通过this.context.lookup(name)
执行JNDI操作,没有任何过滤或者限制,而新增加的代码限制JNDI执行ldap/ldaps。
5 Dec 2021 LOG4J2-3198: Log4j2 no longer formats lookups in messages by default
log4j不再自动对消息中的lookup进行格式化
LOG4J2-3198: Log4j2 no longer formats lookups in messages by default · apache/logging-log4j2@001aaad · GitHub
10 Dec 2021 Handle URI exception
Handle URI exception · apache/logging-log4j2@bac0d8a · GitHub
这