Re:Log4j 2.15.0 – Previously suggested mitigations may not b...
by josefx on Thursday December 16, 2021 @06:23AM
(#29577160)
> and has been defended by some as an "useful" feature.
I would say the feature is useful but the implementation is insane. I would expect a SQL prepared statement approach, only contents of the statement / format string are resolved. Interpreting variables in user provided input just asks for SQL injection attacks and needs to be either prohibited or extremely restricted.
I would say the feature is useful but the implementation is insane. I would expect a SQL prepared statement approach, only contents of the statement / format string are resolved. Interpreting variables in user provided input just asks for SQL injection attacks and needs to be either prohibited or extremely restricted.