Re:Log4j RCE Found
by wyager on Friday December 10, 2021 @09:14AM
(#29510061)
There are several ways to avoid generating log strings that don't involve sketchy ad-hoc templating. Use a language with laziness, put the string generation in a lambda expression, use a language with a good compiler and don't put side effects in your log string expression, etc.
As a matter of principle, it should also clearly not be possible for a templating engine to perform any kind of side effect. That's totally crazy.
As a matter of principle, it should also clearly not be possible for a templating engine to perform any kind of side effect. That's totally crazy.