site_archiver@lists.apple.com Delivered-To: webobjects-dev@lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=salient-doremus.de; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=HD8Z6I3EVppOUrEbSmgSWnhHLMur0BVNSXbnYLFNh5E=; b=HmkPuRPznhcgAORgymuu8dw1a/1XsYMPW8DrN91WkU2CnDG418IoIhT3VlNcVrRWm9rJ4X6Z5TNAGoGZd1Le9/+wBUlNFFJ/OlMn9+XHhS17enfGuwAEsNYrxUjvbkvnEU0nLe3ETwKsHTmGkWZBFuPUTBCxQ2fOJ58Taj33MjVW3ZLrZK8/BnxUQT0oQGr9MteKCA5Tl3eVSwgVBxnAfa6XtMnUyAv30uyOuWeVxt7rXb+CYavr0T/8V3tli13chzYrJRhn6b1lTuqtWiO/LxrRKADYjkm6oJA9DPu0Jn7xjxBzGgsTnKnYWpjaA92fBx/MhAH+ZMfU3H1khq8sfg== Thread-index: AQHYLpD+WhL+69ABeU+HE90cWV3jPK6zBjkAgAD5RIA= Thread-topic: Replacing log4j with slf4j in Wonder Hi, I successfully merged Henriques PR into our Wonder-fork and we are using log4j2 now for our current projects. But in order to get rid of the log4j1.jar, we had to move form ant to maven build. And kick out the JavaXML.framework. I'll like to support Henrique in finalising this PR, but unfortunately, I got no reply from him :-( Regards, René Am 26.01.2023 um 19:11 schrieb Ricardo Parada via Webobjects-dev <webobjects-dev@lists.apple.com<mailto:webobjects-dev@lists.apple.com>>: Hi Henrique, It is true that Wonder uses mostly the Apache commons logging library, e.g. org.apache.commons.logging and a little bit of the log4j 1 library, e.g. org.apache.log4j. That is what I concluded b searching *.jar and *.java files in Wonder. And you mention it in your list of open issues on your pull request, e.g. open issue # 2.8 I do not see Wonder using log4j 2, e.g. org.apache.logging.log4j. So I think technically, it is not affected by vulnerabilities CVE-2021-44228 and CVE-2021-45046 which I’ve been asked to address in our code base. I am interested in your pull request [1]. I took a look at it and I see you have a couple issues left to resolve. For instance, updating five classes that currently extend log4j1 classes. Any progress on that? Do you see this being merged to Wonder anytime soon? Will you wait until the 3 open issues have all been resolved? Is anybody else using it and/or helping you? I’m thinking of applying your pull request to our version of Wonder to see how well it works with our code base. Using slf4j in Wonder and letting the developer choose the actual logging library seems like a winning strategy to me. Thank you, Ricardo Parada [1] https://github.com/wocommunity/wonder/pull/977 On Mar 2, 2022, at 6:55 PM, Henrique Prange via Webobjects-dev <webobjects-dev@lists.apple.com<mailto:webobjects-dev@lists.apple.com>> wrote: Hey guys! I'm replacing the log4j dependency with slf4j in Wonder, as promised. I've created a draft pull request [1] on GitHub so more people can comment, test, and assist me with this change. Please, take a look at it if you have time. Your comments are always welcome. Cheers, HP [1]https://github.com/wocommunity/wonder/pull/977 _______________________________________________ Do not post admin requests to the list. They will be ignored. Webobjects-dev mailing list (Webobjects-dev@lists.apple.com<mailto:Webobjects-dev@lists.apple.com>) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/webobjects-dev/rparada%40mac.com This email sent to rparada@mac.com<mailto:rparada@mac.com> _______________________________________________ Do not post admin requests to the list. They will be ignored. Webobjects-dev mailing list (Webobjects-dev@lists.apple.com<mailto:Webobjects-dev@lists.apple.com>) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/webobjects-dev/bock%40salient-doremu... This email sent to bock@salient-doremus.de _______________________________________________ Do not post admin requests to the list. They will be ignored. Webobjects-dev mailing list (Webobjects-dev@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/webobjects-dev/site_archiver%40lists... This email sent to site_archiver@lists.apple.com