Re: Replacing log4j with slf4j in Wonder
Re: Replacing log4j with slf4j in Wonder
- Subject: Re: Replacing log4j with slf4j in Wonder
- From: René Bock via Webobjects-dev <email@hidden>
- Date: Mon, 13 Mar 2023 09:12:01 +0000
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=salient-doremus.de; dmarc=pass action=none header.from=salient-doremus.de; dkim=pass header.d=salient-doremus.de; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=EF0xDPqS4/oensSGKxT0PbvhgfGfG+kM8WX2NUzNEa4=; b=E7a/WdyaAncQAWjsk7QmgtoOZD38jL9E8nFyacoQKT08jEeDRF0wBf1mSuk70rjbyvTAr+8CkV8dW6F9j0zj24wezIBbGJd0AftAub6eJJ5wNs4EeyWIAyuGyo51GjHFmD3zXX6zoQ1IgIfy8TGPBhnWfnuQiyyaOZQDWpcYUaC/ISktaZTf1x0QlLW5VXhhhyMbSpl+IlQhPKNQ5bE0fX9SUQlYXNASnRC4A3fpRT1HwZVa/Ll9oarBdT5LLN/d52yP65cVRpCiTwFkuJs0Wzd64qKfjeSnkB0q9OpBpegtR8haSCfNZT0SSzH581SDto8sfnI3Yw3kXp5kWFV/qg==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=g6JAlGO/h1IDHvbWrBG9o63/WeVGCDwkzckQ/fHZ4t98XDWp4SmLaiuOQYC8Pdq6mIvekScG2fIz8IcRZPzn7epzjwb+6iGGDsINuRupcF/znqwWMJJztCOgv4fRqSYWTbPIh+Qb8FdMJKU/lemapw+oxbhGwtaGBPlBV5U2TtnOm5u5kZJREzZBML6u1ts1UD6yMUab1HhE1hK89sIELdAWedt4LkKDGurBEfZOIPQiHk+OsAD7sRid1IH35tBf8gMjCnRyzpOKhEMtnMnQxgjgRI/vdwjPVUz4o/OtSXPV0aEiw4pB1Rvvub7u0psHOevCPamaRQbfjwa3PHgPjg==
- Thread-topic: Replacing log4j with slf4j in Wonder
Hi Ricardo,
thanks for your effort. Sounds great.
regards,
René
Am 11.03.2023 um 17:31 schrieb Ricardo Parada
<email@hidden<mailto:email@hidden>>:
Hi René
I used Henrique’s fork to help us advance our Wonder fork to slf4j.
I commented out references to classes in ERXLog4j2LoggingAdapter and
ERXLogbackLoggingAdapter because we still have an ant based build and I don’t
know how to specify optional dependencies as he seems to have done in the
pom.xml for maven.
I am moving classes to separate frameworks as you and him had discussed. For
example, ERLog4j1Extensions, ERLog4j2Extensions and ERLogbackExtensions.
The application decides which logging library to use by adding one of these to
their .classpath / pom.xml.
For this to work I moved the slf4j log4j1 binding library from ERJars to
ERLog4j1Extensions. I also rewrote the currentBinding() and
createLoggingAdapter() in ERXLoggingUtilities to look up classes by name rather
than referencing the classes directly which requires optional dependency for
the code to compile.
My application is working and using ERLog4j1Extensions.
I’m am converting ERXPatternLayout and its converter classes to their
equivalent in log4j2 and I will be putting them in the ERLog4j2Extensions
framework.
Once I have completed that portion and can launch my app successfully I’ll
report back.
Ricardo Parada
On Jan 31, 2023, at 10:42 AM, Ricardo Parada
<email@hidden<mailto:email@hidden>> wrote:
Hi René,
I’m wondering if he got hired by Apple since I have not seen any activity from
him since then. :-)
Anyways, in the coming months I may start trying it out. And possibly start
converting some of the appenders and pattern layout classes from log4j1 to
log4j2. I found some good articles with examples on how those get implemented
for log4j2.
I also saw your suggestion about perhaps moving those library specific classes
to their own framework, e.g. ERXLog4jExtensions, ERXLog4j2Extensions,
ERXLogbackExtensions.
We’re still using an ant based build.
I’m our code base we split the JavaXML framework into 3 separate frameworks
(one for log4j, one for WSDL, and another one for the rest).
Regards,
Ricardo Parada
On Jan 27, 2023, at 4:04 AM, René Bock
<email@hidden<mailto:email@hidden>> wrote:
Hi,
I successfully merged Henriques PR into our Wonder-fork and we are using
log4j2 now for our current projects.
But in order to get rid of the log4j1.jar, we had to move form ant to maven
build. And kick out the JavaXML.framework.
I'll like to support Henrique in finalising this PR, but unfortunately, I got
no reply from him :-(
Regards,
René
Am 26.01.2023 um 19:11 schrieb Ricardo Parada via Webobjects-dev
<email@hidden<mailto:email@hidden>>:
Hi Henrique,
It is true that Wonder uses mostly the Apache commons logging library, e.g.
org.apache.commons.logging and a little bit of the log4j 1 library, e.g.
org.apache.log4j. That is what I concluded b searching *.jar and *.java files
in Wonder.
And you mention it in your list of open issues on your pull request, e.g. open
issue # 2.8
I do not see Wonder using log4j 2, e.g. org.apache.logging.log4j. So I think
technically, it is not affected by vulnerabilities CVE-2021-44228 and
CVE-2021-45046 which I’ve been asked to address in our code base.
I am interested in your pull request [1]. I took a look at it and I see you
have a couple issues left to resolve. For instance, updating five classes that
currently extend log4j1 classes. Any progress on that?
Do you see this being merged to Wonder anytime soon?
Will you wait until the 3 open issues have all been resolved?
Is anybody else using it and/or helping you?
I’m thinking of applying your pull request to our version of Wonder to see how
well it works with our code base.
Using slf4j in Wonder and letting the developer choose the actual logging
library seems like a winning strategy to me.
Thank you,
Ricardo Parada
[1] https://github.com/wocommunity/wonder/pull/977
On Mar 2, 2022, at 6:55 PM, Henrique Prange via Webobjects-dev
<email@hidden<mailto:email@hidden>> wrote:
Hey guys!
I'm replacing the log4j dependency with slf4j in Wonder, as promised. I've
created a draft pull request [1] on GitHub so more people can comment, test,
and assist me with this change. Please, take a look at it if you have time.
Your comments are always welcome.
Cheers,
HP
[1]https://github.com/wocommunity/wonder/pull/977
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Webobjects-dev mailing list
(email@hidden<mailto:email@hidden>)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden<mailto:email@hidden>
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Webobjects-dev mailing list
(email@hidden<mailto:email@hidden>)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden<mailto:email@hidden>
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Webobjects-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden