Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove logback.groovy configuration (incompatible with logback 1.2.9) #12276

Open
arixmkii opened this issue Dec 20, 2021 · 4 comments
Open

Remove logback.groovy configuration (incompatible with logback 1.2.9) #12276

arixmkii opened this issue Dec 20, 2021 · 4 comments

Comments

@arixmkii
Copy link

Logback dropped support for grooovy configuration since 1.2.9.

Details info could be found in news for Dec 16, 2021 http://logback.qos.ch/news.html

There are a lot of mentions of this way for configuring logs in documentation and probably also in templates. Better to remove them.

Current result - application will fail to run (including integration tests) if logback is updated to 1.2.9

@yuri1969
Copy link
Contributor

yuri1969 commented Jan 4, 2022

Just to mention, update to Logback 1.2.9 is desirable since the recent CVE-2021-42550 affecting Logback 1.2.7 and older.

@rainboyan
Copy link
Contributor

There were some discussions from Logback JIRA , grails framework nead to support backward compatibility.

Spring Boot 2.6.2 use Logback 1.2.9 now, so if Grails 5.1.2 upgrade to Spring Boot 2.6.2, it would cause some errors with logback.

@jdaugherty
Copy link
Contributor

jdaugherty commented Jan 5, 2022

Logback still supports programmatic configuration. Grails could:

  1. Implement logback's com.qos.logback.classic.spi.Configurator that looks for the old groovy file
  2. Use a groovy dsl to generate the xml logback expects
  3. Inform users that the first option above is left up to end-users now

@chrisbitmead
Copy link

Is it just me, or is arbitrary code execution when you have access to the server's files, a non-issue?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

5 participants