Fix Log4Shell (CVE-2021-44228): disable JNDI lookups and message substitution by default in v2.15.0

log4j-1.2-api/pom.xml

@@ -20,7 +20,7 @@
   <parent>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j</artifactId>
-    <version>2.14.1</version>
+    <version>2.15.0</version>
     <relativePath>../</relativePath>
   </parent>
   <artifactId>log4j-1.2-api</artifactId>

log4j-api-java9/pom.xml

@@ -20,7 +20,7 @@
   <parent>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j</artifactId>
-    <version>2.14.1</version>
+    <version>2.15.0</version>
     <relativePath>../</relativePath>
   </parent>
   <artifactId>log4j-api-java9</artifactId>

log4j-api/pom.xml

@@ -20,7 +20,7 @@
   <parent>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j</artifactId>
-    <version>2.14.1</version>
+    <version>2.15.0</version>
     <relativePath>../</relativePath>
   </parent>
   <artifactId>log4j-api</artifactId>

log4j-appserver/pom.xml

@@ -20,7 +20,7 @@
   <parent>
     <artifactId>log4j</artifactId>
     <groupId>org.apache.logging.log4j</groupId>
-    <version>2.14.1</version>
+    <version>2.15.0</version>
   </parent>
   <modelVersion>4.0.0</modelVersion>
 

log4j-bom/pom.xml

@@ -26,7 +26,7 @@
   <description>Apache Log4j Bill of Materials</description>
   <groupId>org.apache.logging.log4j</groupId>
   <artifactId>log4j-bom</artifactId>
-  <version>2.14.1</version>
+  <version>2.15.0</version>
   <packaging>pom</packaging>
   <dependencyManagement>
     <dependencies>
@@ -217,6 +217,6 @@
   </build>
 
   <scm>
-    <tag>log4j-2.14.1-rc1</tag>
+    <tag>log4j-2.15.0-rc1</tag>
   </scm>
 </project>

log4j-cassandra/pom.xml

@@ -20,7 +20,7 @@
   <parent>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j</artifactId>
-    <version>2.14.1</version>
+    <version>2.15.0</version>
   </parent>
   <modelVersion>4.0.0</modelVersion>
 

log4j-core-its/pom.xml

@@ -20,7 +20,7 @@
   <parent>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j</artifactId>
-    <version>2.14.1</version>
+    <version>2.15.0</version>
     <relativePath>../</relativePath>
   </parent>
   <artifactId>log4j-core-its</artifactId>

log4j-core-java9/pom.xml

@@ -20,7 +20,7 @@
   <parent>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j</artifactId>
-    <version>2.14.1</version>
+    <version>2.15.0</version>
     <relativePath>../</relativePath>
   </parent>
   <artifactId>log4j-core-java9</artifactId>

log4j-core/pom.xml

@@ -20,7 +20,7 @@
   <parent>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j</artifactId>
-    <version>2.14.1</version>
+    <version>2.15.0</version>
     <relativePath>../</relativePath>
   </parent>
   <artifactId>log4j-core</artifactId>

log4j-core/src/main/java/org/apache/logging/log4j/core/lookup/JndiLookup.java

@@ -27,9 +27,13 @@
 import org.apache.logging.log4j.core.config.plugins.Plugin;
 import org.apache.logging.log4j.core.net.JndiManager;
 import org.apache.logging.log4j.status.StatusLogger;
+import org.apache.logging.log4j.util.PropertiesUtil;
 
 /**
  * Looks up keys from JNDI resources.
+ *
+ * <p>As of 2.15.0, JNDI lookups are disabled by default to address CVE-2021-44228. To enable,
+ * set the system property {@code log4j2.enableJndiLookup} to {@code true}.</p>
  */
 @Plugin(name = "jndi", category = StrLookup.CATEGORY)
 public class JndiLookup extends AbstractLookup {
@@ -40,6 +44,14 @@ public class JndiLookup extends AbstractLookup {
     /** JNDI resource path prefix used in a J2EE container */
     static final String CONTAINER_JNDI_RESOURCE_PATH_PREFIX = "java:comp/env/";
 
+    /**
+     * Returns {@code true} if JNDI lookups are enabled via the {@code log4j2.enableJndiLookup}
+     * system property. Disabled by default as of 2.15.0 (CVE-2021-44228).
+     */
+    static boolean isJndiEnabled() {
+        return PropertiesUtil.getProperties().getBooleanProperty("log4j2.enableJndiLookup", false);
+    }
+
     /**
      * Looks up the value of the JNDI resource.
      * @param event The current LogEvent (is ignored by this StrLookup).
@@ -48,6 +60,10 @@ public class JndiLookup extends AbstractLookup {
      */
     @Override
     public String lookup(final LogEvent event, final String key) {
+        if (!isJndiEnabled()) {
+            LOGGER.warn(LOOKUP, "JNDI lookup is disabled. Set log4j2.enableJndiLookup=true to enable.");
+            return null;
+        }
         if (key == null) {
             return null;
         }

log4j-core/src/main/java/org/apache/logging/log4j/core/util/Constants.java

@@ -58,10 +58,13 @@ public final class Constants {
      * LOG4J2-2109 if {@code true}, MessagePatternConverter will always operate as though
      * <pre>%m{nolookups}</pre> is configured.
      *
+     * <p>Defaults to {@code true} as of 2.15.0 to address CVE-2021-44228. Set to {@code false}
+     * only if you trust all data that may appear in log messages.</p>
+     *
      * @since 2.10
      */
     public static final boolean FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS = PropertiesUtil.getProperties().getBooleanProperty(
-            "log4j2.formatMsgNoLookups", false);
+            "log4j2.formatMsgNoLookups", true);
 
     /**
      * {@code true} if we think we are running in a web container, based on the boolean value of system property

log4j-core/src/test/java/org/apache/logging/log4j/core/appender/routing/RoutingAppenderWithJndiTest.java

@@ -28,7 +28,9 @@
 import org.apache.logging.log4j.message.StructuredDataMessage;
 import org.apache.logging.log4j.test.appender.ListAppender;
 import org.junit.After;
+import org.junit.AfterClass;
 import org.junit.Before;
+import org.junit.BeforeClass;
 import org.junit.ClassRule;
 import org.junit.Test;
 import org.junit.rules.RuleChain;
@@ -37,6 +39,9 @@
 
 /**
  * RoutingAppenderWithJndiTest
+ *
+ * <p>Note: this test explicitly enables JNDI lookups via the {@code log4j2.enableJndiLookup} system
+ * property because JNDI lookups are disabled by default as of 2.15.0 (CVE-2021-44228).</p>
  */
 public class RoutingAppenderWithJndiTest {
 
@@ -50,6 +55,17 @@ public class RoutingAppenderWithJndiTest {
     public static RuleChain rules = RuleChain.outerRule(new JndiRule(Collections.<String, Object>emptyMap()))
         .around(loggerContextRule);
 
+    @BeforeClass
+    public static void enableJndi() {
+        // Explicitly enable JNDI for this test; disabled by default as of 2.15.0 (CVE-2021-44228)
+        System.setProperty("log4j2.enableJndiLookup", "true");
+    }
+
+    @AfterClass
+    public static void disableJndi() {
+        System.clearProperty("log4j2.enableJndiLookup");
+    }
+
     @Before
     public void before() throws NamingException {
         listAppender1 = RoutingAppenderWithJndiTest.loggerContextRule.getListAppender("List1");

log4j-core/src/test/java/org/apache/logging/log4j/core/lookup/InterpolatorTest.java

@@ -22,7 +22,6 @@
 import java.util.Map;
 
 import org.apache.logging.log4j.ThreadContext;
-import org.apache.logging.log4j.junit.JndiRule;
 import org.junit.ClassRule;
 import org.junit.Test;
 import org.junit.rules.ExternalResource;
@@ -39,9 +38,6 @@ public class InterpolatorTest {
     private static final String TESTKEY2 = "TestKey2";
     private static final String TESTVAL = "TestValue";
 
-    private static final String TEST_CONTEXT_RESOURCE_NAME = "logging/context-name";
-    private static final String TEST_CONTEXT_NAME = "app-1";
-
     @ClassRule
     public static RuleChain rules = RuleChain.outerRule(new ExternalResource() {
         @Override
@@ -55,8 +51,7 @@ protected void after() {
             System.clearProperty(TESTKEY);
             System.clearProperty(TESTKEY2);
         }
-    }).around(new JndiRule(
-        JndiLookup.CONTAINER_JNDI_RESOURCE_PATH_PREFIX + TEST_CONTEXT_RESOURCE_NAME, TEST_CONTEXT_NAME));
+    });
 
     @Test
     public void testLookup() {
@@ -77,8 +72,9 @@ public void testLookup() {
         ThreadContext.clearMap();
         value = lookup.lookup("ctx:" + TESTKEY);
         assertEquals(TESTVAL, value);
-        value = lookup.lookup("jndi:" + TEST_CONTEXT_RESOURCE_NAME);
-        assertEquals(TEST_CONTEXT_NAME, value);
+        // JNDI lookup is disabled by default as of 2.15.0 (CVE-2021-44228)
+        value = lookup.lookup("jndi:logging/context-name");
+        assertNull(value);
     }
 
     private void assertLookupNotEmpty(final StrLookup lookup, final String key) {
@@ -95,8 +91,9 @@ public void testLookupWithDefaultInterpolator() {
         assertEquals(TESTVAL, value);
         value = lookup.lookup("env:PATH");
         assertNotNull(value);
-        value = lookup.lookup("jndi:" + TEST_CONTEXT_RESOURCE_NAME);
-        assertEquals(TEST_CONTEXT_NAME, value);
+        // JNDI lookup is disabled by default as of 2.15.0 (CVE-2021-44228)
+        value = lookup.lookup("jndi:logging/context-name");
+        assertNull(value);
         value = lookup.lookup("date:yyyy-MM-dd");
         assertNotNull("No Date", value);
         final SimpleDateFormat format = new SimpleDateFormat("yyyy-MM-dd");

log4j-core/src/test/java/org/apache/logging/log4j/core/lookup/JndiLookupTest.java

@@ -16,13 +16,6 @@
  */
 package org.apache.logging.log4j.core.lookup;
 
-import java.util.Arrays;
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.Map;
-
-import org.apache.logging.log4j.junit.JndiRule;
-import org.junit.Rule;
 import org.junit.Test;
 
 import static org.junit.Assert.*;
@@ -32,45 +25,23 @@
  */
 public class JndiLookupTest {
 
-    private static final String TEST_CONTEXT_RESOURCE_NAME = "logging/context-name";
-    private static final String TEST_CONTEXT_NAME = "app-1";
-    private static final String TEST_INTEGRAL_NAME = "int-value";
-    private static final int TEST_INTEGRAL_VALUE = 42;
-    private static final String TEST_STRINGS_NAME = "string-collection";
-    private static final Collection<String> TEST_STRINGS_COLLECTION = Arrays.asList("one", "two", "three");
-
-    @Rule
-    public JndiRule jndiRule = new JndiRule(createBindings());
-
-    private Map<String, Object> createBindings() {
-        final Map<String, Object> map = new HashMap<>();
-        map.put(JndiLookup.CONTAINER_JNDI_RESOURCE_PATH_PREFIX + TEST_CONTEXT_RESOURCE_NAME, TEST_CONTEXT_NAME);
-        map.put(JndiLookup.CONTAINER_JNDI_RESOURCE_PATH_PREFIX + TEST_INTEGRAL_NAME, TEST_INTEGRAL_VALUE);
-        map.put(JndiLookup.CONTAINER_JNDI_RESOURCE_PATH_PREFIX + TEST_STRINGS_NAME, TEST_STRINGS_COLLECTION);
-        return map;
-    }
-
+    /**
+     * Verifies that JNDI lookups are disabled by default (CVE-2021-44228).
+     */
     @Test
-    public void testLookup() {
-        final StrLookup lookup = new JndiLookup();
-
-        String contextName = lookup.lookup(TEST_CONTEXT_RESOURCE_NAME);
-        assertEquals(TEST_CONTEXT_NAME, contextName);
-
-        contextName = lookup.lookup(JndiLookup.CONTAINER_JNDI_RESOURCE_PATH_PREFIX + TEST_CONTEXT_RESOURCE_NAME);
-        assertEquals(TEST_CONTEXT_NAME, contextName);
-
-        final String nonExistingResource = lookup.lookup("logging/non-existing-resource");
-        assertNull(nonExistingResource);
+    public void testJndiDisabledByDefault() {
+        assertFalse("JNDI lookup must be disabled by default (CVE-2021-44228)",
+                JndiLookup.isJndiEnabled());
     }
 
+    /**
+     * Verifies that a lookup call returns null when JNDI is disabled.
+     */
     @Test
-    public void testNonStringLookup() throws Exception {
-        // LOG4J2-1310
+    public void testLookupReturnsNullWhenDisabled() {
         final StrLookup lookup = new JndiLookup();
-        final String integralValue = lookup.lookup(TEST_INTEGRAL_NAME);
-        assertEquals(String.valueOf(TEST_INTEGRAL_VALUE), integralValue);
-        final String collectionValue = lookup.lookup(TEST_STRINGS_NAME);
-        assertEquals(String.valueOf(TEST_STRINGS_COLLECTION), collectionValue);
+        // JNDI is disabled by default; all lookups should return null
+        assertNull(lookup.lookup("logging/context-name"));
+        assertNull(lookup.lookup(JndiLookup.CONTAINER_JNDI_RESOURCE_PATH_PREFIX + "logging/context-name"));
     }
 }

log4j-core/src/test/java/org/apache/logging/log4j/core/pattern/MessagePatternConverterTest.java

@@ -76,8 +76,8 @@ public void testPatternAndParameterizedMessageDateLookup() {
     }
 
     @Test
-    public void testLookupEnabledByDefault() {
-        assertFalse(Constants.FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS, "Expected lookups to be enabled");
+    public void testLookupDisabledByDefault() {
+        assertTrue(Constants.FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS, "Expected lookups to be disabled by default (CVE-2021-44228)");
     }
 
     @Test
@@ -93,7 +93,8 @@ public void testLookup() {
                 .setMessage(msg).build();
         final StringBuilder sb = new StringBuilder();
         converter.format(event, sb);
-        assertEquals("bar", sb.toString(), "Unexpected result");
+        // Lookups are disabled by default as of 2.15.0 (CVE-2021-44228); pattern is returned as-is
+        assertEquals("${foo}", sb.toString(), "Expected the raw pattern string without lookup");
     }
 
     @Test

log4j-couchdb/pom.xml

@@ -20,7 +20,7 @@
   <parent>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j</artifactId>
-    <version>2.14.1</version>
+    <version>2.15.0</version>
   </parent>
   <modelVersion>4.0.0</modelVersion>
 

log4j-distribution/pom.xml

@@ -20,7 +20,7 @@
   <parent>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j</artifactId>
-    <version>2.14.1</version>
+    <version>2.15.0</version>
     <relativePath>../</relativePath>
   </parent>
   <artifactId>log4j-distribution</artifactId>

log4j-docker/pom.xml

@@ -20,7 +20,7 @@
   <parent>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j</artifactId>
-    <version>2.14.1</version>
+    <version>2.15.0</version>
     <relativePath>../</relativePath>
   </parent>
   <artifactId>log4j-docker</artifactId>

log4j-flume-ng/pom.xml

@@ -20,7 +20,7 @@
   <parent>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j</artifactId>
-    <version>2.14.1</version>
+    <version>2.15.0</version>
     <relativePath>../</relativePath>
   </parent>
   <artifactId>log4j-flume-ng</artifactId>

log4j-iostreams/pom.xml

@@ -20,7 +20,7 @@
   <parent>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j</artifactId>
-    <version>2.14.1</version>
+    <version>2.15.0</version>
     <relativePath>../</relativePath>
   </parent>
   <artifactId>log4j-iostreams</artifactId>

log4j-jcl/pom.xml

@@ -20,7 +20,7 @@
   <parent>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j</artifactId>
-    <version>2.14.1</version>
+    <version>2.15.0</version>
     <relativePath>../</relativePath>
   </parent>
   <artifactId>log4j-jcl</artifactId>

log4j-jdbc-dbcp2/pom.xml

@@ -11,7 +11,7 @@
   <parent>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j</artifactId>
-    <version>2.14.1</version>
+    <version>2.15.0</version>
   </parent>
   <modelVersion>4.0.0</modelVersion>
 

log4j-jmx-gui/pom.xml

@@ -20,7 +20,7 @@
   <parent>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j</artifactId>
-    <version>2.14.1</version>
+    <version>2.15.0</version>
     <relativePath>../</relativePath>
   </parent>
   <artifactId>log4j-jmx-gui</artifactId>