diff --git a/0001-Backport-fix-for-CVE-2017-5645.patch b/0001-Backport-fix-for-CVE-2017-5645.patch new file mode 100644 index 0000000..704ecfc --- /dev/null +++ b/0001-Backport-fix-for-CVE-2017-5645.patch @@ -0,0 +1,127 @@ +From ea4609eca531916ac347686c048bebdb7b4b6e0d Mon Sep 17 00:00:00 2001 +From: Michael Simacek +Date: Fri, 2 Jun 2017 14:37:35 +0200 +Subject: [PATCH] Backport fix for CVE-2017-5645 + +--- + .../apache/log4j/FilteredObjectInputStream.java | 65 ++++++++++++++++++++++ + src/main/java/org/apache/log4j/net/SocketNode.java | 17 +++++- + 2 files changed, 80 insertions(+), 2 deletions(-) + create mode 100644 src/main/java/org/apache/log4j/FilteredObjectInputStream.java + +diff --git a/src/main/java/org/apache/log4j/FilteredObjectInputStream.java b/src/main/java/org/apache/log4j/FilteredObjectInputStream.java +new file mode 100644 +index 0000000..b9ef20c +--- /dev/null ++++ b/src/main/java/org/apache/log4j/FilteredObjectInputStream.java +@@ -0,0 +1,65 @@ ++/* ++ * Licensed to the Apache Software Foundation (ASF) under one or more ++ * contributor license agreements. See the NOTICE file distributed with ++ * this work for additional information regarding copyright ownership. ++ * The ASF licenses this file to You under the Apache license, Version 2.0 ++ * (the "License"); you may not use this file except in compliance with ++ * the License. You may obtain a copy of the License at ++ * ++ * http://www.apache.org/licenses/LICENSE-2.0 ++ * ++ * Unless required by applicable law or agreed to in writing, software ++ * distributed under the License is distributed on an "AS IS" BASIS, ++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. ++ * See the license for the specific language governing permissions and ++ * limitations under the license. ++ */ ++package org.apache.log4j; ++ ++import java.io.FileOutputStream; ++import java.io.IOException; ++import java.io.InputStream; ++import java.io.InvalidObjectException; ++import java.io.ObjectInputStream; ++import java.io.ObjectStreamClass; ++import java.util.Arrays; ++import java.util.Collection; ++import java.util.List; ++ ++/** ++ * Extended ObjectInputStream that only allows certain classes to be deserialized. ++ * ++ * Backported from 2.8.2 ++ */ ++public class FilteredObjectInputStream extends ObjectInputStream { ++ ++ private static final List REQUIRED_JAVA_CLASSES = Arrays.asList(new String[] { ++ // Types of non-trainsient fields of LoggingEvent ++ "java.lang.String", ++ "java.util.Hashtable", ++ // ThrowableInformation ++ "[Ljava.lang.String;" ++ }); ++ ++ private final Collection allowedClasses; ++ ++ public FilteredObjectInputStream(final InputStream in, final Collection allowedClasses) throws IOException { ++ super(in); ++ this.allowedClasses = allowedClasses; ++ } ++ ++ protected Class resolveClass(final ObjectStreamClass desc) throws IOException, ClassNotFoundException { ++ String name = desc.getName(); ++ if (!(isAllowedByDefault(name) || allowedClasses.contains(name))) { ++ throw new InvalidObjectException("Class is not allowed for deserialization: " + name); ++ } ++ return super.resolveClass(desc); ++ } ++ ++ private static boolean isAllowedByDefault(final String name) { ++ return name.startsWith("org.apache.log4j.") || ++ name.startsWith("[Lorg.apache.log4j.") || ++ REQUIRED_JAVA_CLASSES.contains(name); ++ } ++ ++} +diff --git a/src/main/java/org/apache/log4j/net/SocketNode.java b/src/main/java/org/apache/log4j/net/SocketNode.java +index e977f13..f95bb10 100644 +--- a/src/main/java/org/apache/log4j/net/SocketNode.java ++++ b/src/main/java/org/apache/log4j/net/SocketNode.java +@@ -22,6 +22,10 @@ import java.io.IOException; + import java.io.InterruptedIOException; + import java.io.ObjectInputStream; + import java.net.Socket; ++import java.util.ArrayList; ++import java.util.Arrays; ++import java.util.Collection; ++import org.apache.log4j.FilteredObjectInputStream; + + import org.apache.log4j.Logger; + import org.apache.log4j.spi.LoggerRepository; +@@ -53,8 +57,9 @@ public class SocketNode implements Runnable { + this.socket = socket; + this.hierarchy = hierarchy; + try { +- ois = new ObjectInputStream( +- new BufferedInputStream(socket.getInputStream())); ++ ois = new FilteredObjectInputStream( ++ new BufferedInputStream(socket.getInputStream()), ++ getAllowedClasses()); + } catch(InterruptedIOException e) { + Thread.currentThread().interrupt(); + logger.error("Could not open ObjectInputStream to "+socket, e); +@@ -65,6 +70,14 @@ public class SocketNode implements Runnable { + } + } + ++ private Collection getAllowedClasses() { ++ Collection allowedClasses = new ArrayList(); ++ String property = System.getProperty("org.apache.log4j.net.allowedClasses"); ++ if (property != null) ++ allowedClasses.addAll(Arrays.asList(property.split(","))); ++ return allowedClasses; ++ } ++ + //public + //void finalize() { + //System.err.println("-------------------------Finalize called"); +-- +2.9.4 + diff --git a/0001-logfactor5-changed-userdir.patch b/0001-logfactor5-changed-userdir.patch new file mode 100644 index 0000000..95aa5fa --- /dev/null +++ b/0001-logfactor5-changed-userdir.patch @@ -0,0 +1,56 @@ +From bf8f55bbc9baddcb67d0b89edd859f93ce3c949f Mon Sep 17 00:00:00 2001 +From: Stanislav Ochotnicky +Date: Mon, 17 May 2010 12:57:36 +0200 +Subject: [PATCH 01/10] logfactor5 changed userdir + +--- + .../lf5/viewer/configure/ConfigurationManager.java | 2 +- + .../log4j/lf5/viewer/configure/MRUFileManager.java | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/src/main/java/org/apache/log4j/lf5/viewer/configure/ConfigurationManager.java b/src/main/java/org/apache/log4j/lf5/viewer/configure/ConfigurationManager.java +index a94ffab..81191f2 100644 +--- a/src/main/java/org/apache/log4j/lf5/viewer/configure/ConfigurationManager.java ++++ b/src/main/java/org/apache/log4j/lf5/viewer/configure/ConfigurationManager.java +@@ -344,7 +344,7 @@ public class ConfigurationManager extends Object { + String home = System.getProperty("user.home"); + String sep = System.getProperty("file.separator"); + +- return home + sep + "lf5" + sep + CONFIG_FILE_NAME; ++ return home + sep + ".logfactor5" + sep + CONFIG_FILE_NAME; + } + + //-------------------------------------------------------------------------- +diff --git a/src/main/java/org/apache/log4j/lf5/viewer/configure/MRUFileManager.java b/src/main/java/org/apache/log4j/lf5/viewer/configure/MRUFileManager.java +index 6ff275d..ca40d5a 100644 +--- a/src/main/java/org/apache/log4j/lf5/viewer/configure/MRUFileManager.java ++++ b/src/main/java/org/apache/log4j/lf5/viewer/configure/MRUFileManager.java +@@ -175,14 +175,14 @@ public class MRUFileManager { + + /** + * Creates the directory where the MRU file list will be written. +- * The "lf5" directory is created in the Documents and Settings ++ * The ".logfactor5" directory is created in the Documents and Settings + * directory on Windows 2000 machines and where ever the user.home + * variable points on all other platforms. + */ + public static void createConfigurationDirectory() { + String home = System.getProperty("user.home"); + String sep = System.getProperty("file.separator"); +- File f = new File(home + sep + "lf5"); ++ File f = new File(home + sep + ".logfactor5"); + if (!f.exists()) { + try { + f.mkdir(); +@@ -268,7 +268,7 @@ public class MRUFileManager { + String home = System.getProperty("user.home"); + String sep = System.getProperty("file.separator"); + +- return home + sep + "lf5" + sep + CONFIG_FILE_NAME; ++ return home + sep + ".logfactor5" + sep + CONFIG_FILE_NAME; + } + + /** +-- +1.6.6.1 + diff --git a/0009-Fix-tests.patch b/0009-Fix-tests.patch new file mode 100644 index 0000000..3918a50 --- /dev/null +++ b/0009-Fix-tests.patch @@ -0,0 +1,34 @@ +From 91349164c1d44eec50ac1b09ef3e2ff41b4aa468 Mon Sep 17 00:00:00 2001 +From: Michal Srb +Date: Thu, 11 Jul 2013 11:13:45 +0200 +Subject: [PATCH] Fix tests + +--- + tests/build.xml | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tests/build.xml b/tests/build.xml +index 74a7139..9149da2 100644 +--- a/tests/build.xml ++++ b/tests/build.xml +@@ -31,13 +31,13 @@ + the Maven repository can provide all the dependencies. --> + + +- ++ + + +- +- ++ ++ + +- ++ + + + +-- +1.8.1.4 + diff --git a/0010-Fix-javadoc-link.patch b/0010-Fix-javadoc-link.patch new file mode 100644 index 0000000..e60ed57 --- /dev/null +++ b/0010-Fix-javadoc-link.patch @@ -0,0 +1,25 @@ +From 4753784d3e8ed5ec9973f67e9017bcb7ef41b4b1 Mon Sep 17 00:00:00 2001 +From: Stanislav Ochotnicky +Date: Tue, 18 May 2010 15:07:00 +0200 +Subject: [PATCH 10/10] Fix javadoc link + +--- + build.xml | 3 +-- + 1 files changed, 1 insertions(+), 2 deletions(-) + +diff --git a/build.xml b/build.xml +index 54bad8f..c775a68 100644 +--- a/build.xml ++++ b/build.xml +@@ -517,8 +517,7 @@ + -->' + bottom="Copyright 2000-2007 Apache Software Foundation."> + +- +- ++ + + + +-- +1.6.6.1 \ No newline at end of file diff --git a/log4j.catalog b/log4j.catalog new file mode 100644 index 0000000..16dca75 --- /dev/null +++ b/log4j.catalog @@ -0,0 +1,5 @@ +-- log4j DTD catalog -- +-- JPackage Project -- + +DOCTYPE log4j:configuration log4j.dtd +PUBLIC "-//APACHE//DTD LOG4J 1.2//EN" log4j.dtd \ No newline at end of file diff --git a/log4j12.spec b/log4j12.spec new file mode 100644 index 0000000..91e8f59 --- /dev/null +++ b/log4j12.spec @@ -0,0 +1,123 @@ +Name: log4j12 +Version: 1.2.17 +Release: 24 +Summary: A logging library for Java +License: ASL 2.0 +URL: http://logging.apache.org/log4j/1.2/ +BuildArch: noarch +Source0: https://github.com/apache/log4j/archive/v1_2_17.tar.gz +Source1: log4j.catalog + +Patch0000: 0001-logfactor5-changed-userdir.patch +Patch0001: 0009-Fix-tests.patch +Patch0002: 0010-Fix-javadoc-link.patch +Patch0003: 0001-Backport-fix-for-CVE-2017-5645.patch + +BuildRequires: maven-local mvn(ant-contrib:ant-contrib) mvn(javax.mail:mail) +BuildRequires: mvn(junit:junit) mvn(org.apache.ant:ant-junit) +BuildRequires: mvn(org.apache.felix:maven-bundle-plugin) +BuildRequires: mvn(org.apache.geronimo.specs:geronimo-jms_1.1_spec) +BuildRequires: mvn(org.apache.maven.plugins:maven-antrun-plugin) +BuildRequires: mvn(org.apache.maven.plugins:maven-assembly-plugin) +BuildRequires: mvn(oro:oro) mvn(org.apache.ant:ant-nodeps) + +Obsoletes: log4j <= 0:1.2.17-14 + +%description +With log4j it is possible to enable logging at runtime +without modifying the application binary. + +%package help +Summary: Help for log4j12 +Provides: log4j12-doc = %{version}-%{release} +Obsoletes: log4j12-doc < %{version}-%{release} + +%description help +This package contains help for log4j12. + +%prep +%autosetup -n log4j-1_2_17 -p1 + +find . \( -name "*.jar" -o -name "*.class" -o -name "*.dll" \) -exec rm -f {} \; +rm -rf docs/api + +%pom_remove_plugin :clirr-maven-plugin +%pom_remove_plugin :maven-site-plugin +%pom_remove_plugin :maven-source-plugin +%pom_remove_plugin :rat-maven-plugin +%pom_xpath_remove "pom:build/pom:plugins/pom:plugin[pom:artifactId = 'maven-javadoc-plugin']/pom:executions" + +%pom_remove_dep org.apache.openejb:javaee-api + +sed -i.ant "s|groupId>ant<|groupId>org.apache.ant<|g" pom.xml + +sed -i.javac "s|1.4|1.6|g" pom.xml build.xml +sed -i.javac "s|1.1|1.6|g" tests/build.xml + +sed -i.javax.jmdns "s|javax.jmdns.*;resolution:=optional,|!javax.jmdns.*,|g" pom.xml +%pom_xpath_inject "pom:build/pom:plugins/pom:plugin[pom:artifactId = 'maven-bundle-plugin']/pom:configuration/pom:instructions" " + org.apache.log4j + <_nouses>true" + +%pom_xpath_remove "pom:build/pom:plugins/pom:plugin[pom:artifactId = 'maven-antrun-plugin']/pom:executions/pom:execution[pom:phase = 'process-classes' ]" + +%pom_xpath_set "pom:plugin[pom:artifactId='maven-assembly-plugin']/pom:executions/pom:execution/pom:goals/pom:goal[text()='assembly']" single + +install -d tests/lib/ + +cd tests/lib/ +ln -s `build-classpath jakarta-oro` +ln -s `build-classpath javamail/mail` +ln -s `build-classpath junit` +cd - + +%mvn_compat_version log4j:log4j 1.2.17 1.2.16 1.2.15 1.2.14 1.2.13 1.2.12 12 +rm -r src/main/java/org/apache/log4j/nt/NTEventLogAppender.java tests/src/java/org/apache/log4j/nt/NTEventLogAppenderTest.java + +find tests/src/java/org/apache/log4j/net/TelnetAppenderTest.java -delete +sed -i '/TelnetAppenderTest/d' tests/src/java/org/apache/log4j/CoreTestSuite.java + +%mvn_file log4j:log4j log4j %{name} + +%build +%mvn_build + +%install +%mvn_install -X + +ln -s log4j-%{version}.jar %{buildroot}%{_javadir}/log4j-1.jar + +install -pD -T -m 644 src/main/javadoc/org/apache/log4j/xml/doc-files/log4j.dtd %{buildroot}%{_datadir}/sgml/log4j/log4j.dtd +install -pD -T -m 644 %{SOURCE1} %{buildroot}%{_datadir}/sgml/log4j/catalog + +%post +if [ -x %{_bindir}/install-catalog -a -d %{_sysconfdir}/sgml ]; then + %{_bindir}/install-catalog --add %{_sysconfdir}/sgml/log4j-%{version}-%{release}.cat %{_datadir}/sgml/log4j/catalog > /dev/null || : +fi +if [ -x %{_bindir}/xmlcatalog -a -w %{_sysconfdir}/xml/catalog ]; then + %{_bindir}/xmlcatalog --noout --add public "-//APACHE//DTD LOG4J 1.2//EN" file://%{_datadir}/sgml/log4j/log4j.dtd %{_sysconfdir}/xml/catalog > /dev/null + %{_bindir}/xmlcatalog --noout --add system log4j.dtd file://%{_datadir}/sgml/log4j/log4j.dtd %{_sysconfdir}/xml/catalog > /dev/null || : +fi + +%preun +if [ $1 -eq 0 ]; then + if [ -x %{_bindir}/xmlcatalog -a -w %{_sysconfdir}/xml/catalog ]; then + %{_bindir}/xmlcatalog --noout --del file://%{_datadir}/sgml/log4j/log4j.dtd %{_sysconfdir}/xml/catalog > /dev/null || : + fi +fi + +%postun +if [ -x %{_bindir}/install-catalog -a -d %{_sysconfdir}/sgml ]; then + %{_bindir}/install-catalog --remove %{_sysconfdir}/sgml/log4j-%{version}-%{release}.cat %{_datadir}/sgml/log4j/catalog > /dev/null || : +fi + +%files -f .mfiles +%{_javadir}/log4j-1.jar +%{_datadir}/sgml/log4j +%license LICENSE NOTICE + +%files help -f .mfiles-javadoc + +%changelog +* Fri Dec 13 2019 openEuler Buildteam - 1.2.17-24 +- Package init diff --git a/v1_2_17.tar.gz b/v1_2_17.tar.gz new file mode 100644 index 0000000..f9e0322 Binary files /dev/null and b/v1_2_17.tar.gz differ