From 1574a1d95ee5bd6fe7ddaf9bb6c4658b7f1d71b3 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Nov 01 2019 17:18:50 +0000 Subject: import log4j-1.2.17-16.el7_4 --- diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..58ba096 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +SOURCES/log4j-1.2.17.tar.gz diff --git a/.log4j.metadata b/.log4j.metadata new file mode 100644 index 0000000..5d5dd15 --- /dev/null +++ b/.log4j.metadata @@ -0,0 +1 @@ +5cfc7a5b8042fada2d2030f1ddbfd165c769fdc6 SOURCES/log4j-1.2.17.tar.gz diff --git a/SOURCES/0001-Backport-fix-for-CVE-2017-5645.patch b/SOURCES/0001-Backport-fix-for-CVE-2017-5645.patch new file mode 100644 index 0000000..704ecfc --- /dev/null +++ b/SOURCES/0001-Backport-fix-for-CVE-2017-5645.patch @@ -0,0 +1,127 @@ +From ea4609eca531916ac347686c048bebdb7b4b6e0d Mon Sep 17 00:00:00 2001 +From: Michael Simacek +Date: Fri, 2 Jun 2017 14:37:35 +0200 +Subject: [PATCH] Backport fix for CVE-2017-5645 + +--- + .../apache/log4j/FilteredObjectInputStream.java | 65 ++++++++++++++++++++++ + src/main/java/org/apache/log4j/net/SocketNode.java | 17 +++++- + 2 files changed, 80 insertions(+), 2 deletions(-) + create mode 100644 src/main/java/org/apache/log4j/FilteredObjectInputStream.java + +diff --git a/src/main/java/org/apache/log4j/FilteredObjectInputStream.java b/src/main/java/org/apache/log4j/FilteredObjectInputStream.java +new file mode 100644 +index 0000000..b9ef20c +--- /dev/null ++++ b/src/main/java/org/apache/log4j/FilteredObjectInputStream.java +@@ -0,0 +1,65 @@ ++/* ++ * Licensed to the Apache Software Foundation (ASF) under one or more ++ * contributor license agreements. See the NOTICE file distributed with ++ * this work for additional information regarding copyright ownership. ++ * The ASF licenses this file to You under the Apache license, Version 2.0 ++ * (the "License"); you may not use this file except in compliance with ++ * the License. You may obtain a copy of the License at ++ * ++ * http://www.apache.org/licenses/LICENSE-2.0 ++ * ++ * Unless required by applicable law or agreed to in writing, software ++ * distributed under the License is distributed on an "AS IS" BASIS, ++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. ++ * See the license for the specific language governing permissions and ++ * limitations under the license. ++ */ ++package org.apache.log4j; ++ ++import java.io.FileOutputStream; ++import java.io.IOException; ++import java.io.InputStream; ++import java.io.InvalidObjectException; ++import java.io.ObjectInputStream; ++import java.io.ObjectStreamClass; ++import java.util.Arrays; ++import java.util.Collection; ++import java.util.List; ++ ++/** ++ * Extended ObjectInputStream that only allows certain classes to be deserialized. ++ * ++ * Backported from 2.8.2 ++ */ ++public class FilteredObjectInputStream extends ObjectInputStream { ++ ++ private static final List REQUIRED_JAVA_CLASSES = Arrays.asList(new String[] { ++ // Types of non-trainsient fields of LoggingEvent ++ "java.lang.String", ++ "java.util.Hashtable", ++ // ThrowableInformation ++ "[Ljava.lang.String;" ++ }); ++ ++ private final Collection allowedClasses; ++ ++ public FilteredObjectInputStream(final InputStream in, final Collection allowedClasses) throws IOException { ++ super(in); ++ this.allowedClasses = allowedClasses; ++ } ++ ++ protected Class resolveClass(final ObjectStreamClass desc) throws IOException, ClassNotFoundException { ++ String name = desc.getName(); ++ if (!(isAllowedByDefault(name) || allowedClasses.contains(name))) { ++ throw new InvalidObjectException("Class is not allowed for deserialization: " + name); ++ } ++ return super.resolveClass(desc); ++ } ++ ++ private static boolean isAllowedByDefault(final String name) { ++ return name.startsWith("org.apache.log4j.") || ++ name.startsWith("[Lorg.apache.log4j.") || ++ REQUIRED_JAVA_CLASSES.contains(name); ++ } ++ ++} +diff --git a/src/main/java/org/apache/log4j/net/SocketNode.java b/src/main/java/org/apache/log4j/net/SocketNode.java +index e977f13..f95bb10 100644 +--- a/src/main/java/org/apache/log4j/net/SocketNode.java ++++ b/src/main/java/org/apache/log4j/net/SocketNode.java +@@ -22,6 +22,10 @@ import java.io.IOException; + import java.io.InterruptedIOException; + import java.io.ObjectInputStream; + import java.net.Socket; ++import java.util.ArrayList; ++import java.util.Arrays; ++import java.util.Collection; ++import org.apache.log4j.FilteredObjectInputStream; + + import org.apache.log4j.Logger; + import org.apache.log4j.spi.LoggerRepository; +@@ -53,8 +57,9 @@ public class SocketNode implements Runnable { + this.socket = socket; + this.hierarchy = hierarchy; + try { +- ois = new ObjectInputStream( +- new BufferedInputStream(socket.getInputStream())); ++ ois = new FilteredObjectInputStream( ++ new BufferedInputStream(socket.getInputStream()), ++ getAllowedClasses()); + } catch(InterruptedIOException e) { + Thread.currentThread().interrupt(); + logger.error("Could not open ObjectInputStream to "+socket, e); +@@ -65,6 +70,14 @@ public class SocketNode implements Runnable { + } + } + ++ private Collection getAllowedClasses() { ++ Collection allowedClasses = new ArrayList(); ++ String property = System.getProperty("org.apache.log4j.net.allowedClasses"); ++ if (property != null) ++ allowedClasses.addAll(Arrays.asList(property.split(","))); ++ return allowedClasses; ++ } ++ + //public + //void finalize() { + //System.err.println("-------------------------Finalize called"); +-- +2.9.4 + diff --git a/SOURCES/0001-logfactor5-changed-userdir.patch b/SOURCES/0001-logfactor5-changed-userdir.patch new file mode 100644 index 0000000..95aa5fa --- /dev/null +++ b/SOURCES/0001-logfactor5-changed-userdir.patch @@ -0,0 +1,56 @@ +From bf8f55bbc9baddcb67d0b89edd859f93ce3c949f Mon Sep 17 00:00:00 2001 +From: Stanislav Ochotnicky +Date: Mon, 17 May 2010 12:57:36 +0200 +Subject: [PATCH 01/10] logfactor5 changed userdir + +--- + .../lf5/viewer/configure/ConfigurationManager.java | 2 +- + .../log4j/lf5/viewer/configure/MRUFileManager.java | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/src/main/java/org/apache/log4j/lf5/viewer/configure/ConfigurationManager.java b/src/main/java/org/apache/log4j/lf5/viewer/configure/ConfigurationManager.java +index a94ffab..81191f2 100644 +--- a/src/main/java/org/apache/log4j/lf5/viewer/configure/ConfigurationManager.java ++++ b/src/main/java/org/apache/log4j/lf5/viewer/configure/ConfigurationManager.java +@@ -344,7 +344,7 @@ public class ConfigurationManager extends Object { + String home = System.getProperty("user.home"); + String sep = System.getProperty("file.separator"); + +- return home + sep + "lf5" + sep + CONFIG_FILE_NAME; ++ return home + sep + ".logfactor5" + sep + CONFIG_FILE_NAME; + } + + //-------------------------------------------------------------------------- +diff --git a/src/main/java/org/apache/log4j/lf5/viewer/configure/MRUFileManager.java b/src/main/java/org/apache/log4j/lf5/viewer/configure/MRUFileManager.java +index 6ff275d..ca40d5a 100644 +--- a/src/main/java/org/apache/log4j/lf5/viewer/configure/MRUFileManager.java ++++ b/src/main/java/org/apache/log4j/lf5/viewer/configure/MRUFileManager.java +@@ -175,14 +175,14 @@ public class MRUFileManager { + + /** + * Creates the directory where the MRU file list will be written. +- * The "lf5" directory is created in the Documents and Settings ++ * The ".logfactor5" directory is created in the Documents and Settings + * directory on Windows 2000 machines and where ever the user.home + * variable points on all other platforms. + */ + public static void createConfigurationDirectory() { + String home = System.getProperty("user.home"); + String sep = System.getProperty("file.separator"); +- File f = new File(home + sep + "lf5"); ++ File f = new File(home + sep + ".logfactor5"); + if (!f.exists()) { + try { + f.mkdir(); +@@ -268,7 +268,7 @@ public class MRUFileManager { + String home = System.getProperty("user.home"); + String sep = System.getProperty("file.separator"); + +- return home + sep + "lf5" + sep + CONFIG_FILE_NAME; ++ return home + sep + ".logfactor5" + sep + CONFIG_FILE_NAME; + } + + /** +-- +1.6.6.1 + diff --git a/SOURCES/0006-Remove-mvn-clirr-plugin.patch b/SOURCES/0006-Remove-mvn-clirr-plugin.patch new file mode 100644 index 0000000..bf632ca --- /dev/null +++ b/SOURCES/0006-Remove-mvn-clirr-plugin.patch @@ -0,0 +1,40 @@ +From 324dcac505e1c2c3f313392769713cff2aec2d59 Mon Sep 17 00:00:00 2001 +From: Stanislav Ochotnicky +Date: Mon, 17 May 2010 13:59:46 +0200 +Subject: [PATCH 06/10] Remove mvn-clirr-plugin + +for now this is included in current mvn in Fedora. Remove once +clirr-plugin is separate +--- + pom.xml | 15 --------------- + 1 files changed, 0 insertions(+), 15 deletions(-) + +diff --git a/pom.xml b/pom.xml +index c273581..6e32bb7 100644 +--- a/pom.xml ++++ b/pom.xml +@@ -350,21 +350,6 @@ target platform and specify -Dntdll_target=msbuild on the mvn command line. + + + +- +- +- org.codehaus.mojo +- clirr-maven-plugin +- 2.2.2 +- +- 1.2.15 +- +- + + org.codehaus.mojo + rat-maven-plugin +-- +1.6.6.1 + diff --git a/SOURCES/0009-Fix-tests.patch b/SOURCES/0009-Fix-tests.patch new file mode 100644 index 0000000..3918a50 --- /dev/null +++ b/SOURCES/0009-Fix-tests.patch @@ -0,0 +1,34 @@ +From 91349164c1d44eec50ac1b09ef3e2ff41b4aa468 Mon Sep 17 00:00:00 2001 +From: Michal Srb +Date: Thu, 11 Jul 2013 11:13:45 +0200 +Subject: [PATCH] Fix tests + +--- + tests/build.xml | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tests/build.xml b/tests/build.xml +index 74a7139..9149da2 100644 +--- a/tests/build.xml ++++ b/tests/build.xml +@@ -31,13 +31,13 @@ + the Maven repository can provide all the dependencies. --> + + +- ++ + + +- +- ++ ++ + +- ++ + + + +-- +1.8.1.4 + diff --git a/SOURCES/0010-Fix-javadoc-link.patch b/SOURCES/0010-Fix-javadoc-link.patch new file mode 100644 index 0000000..44a7cc2 --- /dev/null +++ b/SOURCES/0010-Fix-javadoc-link.patch @@ -0,0 +1,26 @@ +From 4753784d3e8ed5ec9973f67e9017bcb7ef41b4b1 Mon Sep 17 00:00:00 2001 +From: Stanislav Ochotnicky +Date: Tue, 18 May 2010 15:07:00 +0200 +Subject: [PATCH 10/10] Fix javadoc link + +--- + build.xml | 3 +-- + 1 files changed, 1 insertions(+), 2 deletions(-) + +diff --git a/build.xml b/build.xml +index 54bad8f..c775a68 100644 +--- a/build.xml ++++ b/build.xml +@@ -517,8 +517,7 @@ + -->' + bottom="Copyright 2000-2007 Apache Software Foundation."> + +- +- ++ + + + +-- +1.6.6.1 + diff --git a/SOURCES/0011-Remove-openejb.patch b/SOURCES/0011-Remove-openejb.patch new file mode 100644 index 0000000..1e11911 --- /dev/null +++ b/SOURCES/0011-Remove-openejb.patch @@ -0,0 +1,30 @@ +From 003125dc826417e1bf41b4a1bc344eeca715e3cf Mon Sep 17 00:00:00 2001 +From: Stanislav Ochotnicky +Date: Thu, 14 Jun 2012 10:33:03 +0200 +Subject: [PATCH 1/2] Remove openejb from dependencies + +--- + pom.xml | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/pom.xml b/pom.xml +index 8ddbbc2..a627c48 100644 +--- a/pom.xml ++++ b/pom.xml +@@ -528,13 +528,6 @@ target platform and specify -Dntdll_target=msbuild on the mvn command line. + 1.4.3 + true + +- +- org.apache.openejb +- javaee-api +- 5.0-2 +- jar +- provided +- +