-
Notifications
You must be signed in to change notification settings - Fork 864
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add errorprone to prevent Log4j direct usage #3759
Changes from all commits
ffc1e51
1220170
e8b68d4
c6237cf
a29b37c
017d9c9
03d1187
0c265ac
0c0417f
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,60 @@ | ||
/* | ||
* Copyright contributors to Hyperledger Besu. | ||
* | ||
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with | ||
* the License. You may obtain a copy of the License at | ||
* | ||
* http://www.apache.org/licenses/LICENSE-2.0 | ||
* | ||
* Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on | ||
* an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the | ||
* specific language governing permissions and limitations under the License. | ||
* | ||
* SPDX-License-Identifier: Apache-2.0 | ||
*/ | ||
package org.hyperledger.besu.cli.options.stable; | ||
|
||
import static org.assertj.core.api.Assertions.assertThat; | ||
import static org.mockito.Answers.RETURNS_DEEP_STUBS; | ||
|
||
import java.util.Arrays; | ||
|
||
import org.apache.logging.log4j.Level; | ||
import org.junit.Before; | ||
import org.junit.Test; | ||
import org.mockito.Mockito; | ||
import picocli.CommandLine.Model.CommandSpec; | ||
import picocli.CommandLine.ParameterException; | ||
|
||
public class LoggingLevelOptionTest { | ||
|
||
private LoggingLevelOption levelOption; | ||
|
||
@Before | ||
public void setUp() { | ||
levelOption = new LoggingLevelOption(); | ||
} | ||
|
||
@Test | ||
public void fatalLevelEqualsToError() { | ||
levelOption.setLogLevel("fatal"); | ||
assertThat(levelOption.getLogLevel()).isEqualTo(Level.ERROR); | ||
} | ||
|
||
@Test | ||
public void setsExpectedLevels() { | ||
Arrays.stream(Level.values()) | ||
.filter(level -> !Level.FATAL.equals(level)) | ||
.forEach( | ||
level -> { | ||
levelOption.setLogLevel(level.name()); | ||
assertThat(levelOption.getLogLevel()).isEqualTo(level); | ||
}); | ||
} | ||
|
||
@Test(expected = ParameterException.class) | ||
public void failsOnUnknownLevel() { | ||
levelOption.spec = Mockito.mock(CommandSpec.class, RETURNS_DEEP_STUBS); | ||
levelOption.setLogLevel("unknown"); | ||
} | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -25,6 +25,7 @@ | |
|
||
import java.util.Arrays; | ||
import java.util.Optional; | ||
import java.util.Set; | ||
|
||
import org.apache.logging.log4j.Level; | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Can this use of Log4J be removed? How needed is it? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Yes. We can make |
||
import org.slf4j.Logger; | ||
|
@@ -33,6 +34,8 @@ | |
public class AdminChangeLogLevel implements JsonRpcMethod { | ||
|
||
private static final Logger LOG = LoggerFactory.getLogger(AdminChangeLogLevel.class); | ||
private static final Set<String> VALID_PARAMS = | ||
Set.of("OFF", "ERROR", "WARN", "INFO", "DEBUG", "TRACE", "ALL"); | ||
|
||
@Override | ||
public String getName() { | ||
|
@@ -42,7 +45,12 @@ public String getName() { | |
@Override | ||
public JsonRpcResponse response(final JsonRpcRequestContext requestContext) { | ||
try { | ||
final Level logLevel = requestContext.getRequiredParameter(0, Level.class); | ||
final String rawLogLevel = requestContext.getRequiredParameter(0, String.class); | ||
if (!VALID_PARAMS.contains(rawLogLevel)) { | ||
return new JsonRpcErrorResponse( | ||
requestContext.getRequest().getId(), JsonRpcError.INVALID_PARAMS); | ||
} | ||
final Level logLevel = Level.toLevel(rawLogLevel); | ||
final Optional<String[]> optionalLogFilters = | ||
requestContext.getOptionalParameter(1, String[].class); | ||
optionalLogFilters.ifPresentOrElse( | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should this include the other log4j methods that were removed in this PR? static methods on
org.apache.logging.log4j.core.config.Configurator
,org.apache.logging.log4j.ThreadContext
, instance methods on importorg.apache.logging.log4j.core.LoggerContext
,org.apache.logging.log4j.core.config.Configuration
,org.apache.logging.log4j.core.config.LoggerConfig
? Or is there a way to go full Ender-Wiggin on it and have it fail for any class from the log4j packages?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No, we cannot rip off the whole package because we still have hard dependencies on it. The most visible one is
o.h.b.util.Log4j2ConfiguratorUtil
but we also depend ono.a.l.log4j.Level
for the CLI. I went on banning justo.a.l.log4j.LogManager
b/c it's the most common entry point to the Log4j framework from the day to day developer perspective