Skip to content

Commit c4078e7

Browse files
cmagliecmaglie
authored
Merge pull request #11730 from cmaglie/remove_log4j
Remove log4j, to fix current and future CVEs.
2 parents dfeff7d + c16b9f5 commit c4078e7

20 files changed

+31
-188
lines changed

‎app/.classpath

-2
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,6 @@
3838
<classpathentry kind="lib" path="lib/jmdns-3.5.5.jar"/>
3939
<classpathentry kind="lib" path="lib/slf4j-api-1.7.22.jar"/>
4040
<classpathentry kind="lib" path="lib/slf4j-simple-1.7.22.jar"/>
41-
<classpathentry kind="lib" path="lib/log4j-api-2.16.0.jar"/>
42-
<classpathentry kind="lib" path="lib/log4j-core-2.16.0.jar"/>
4341
<classpathentry kind="lib" path="lib/jsch-0.1.50.jar"/>
4442
<classpathentry kind="lib" path="lib/rsyntaxtextarea-3.0.3-SNAPSHOT.jar"/>
4543
<classpathentry kind="lib" path="lib/xml-apis-1.3.04.jar"/>

‎app/build.xml

-4
Original file line numberDiff line numberDiff line change
@@ -80,10 +80,6 @@
8080
includeAntRuntime="false"
8181
debug="true"
8282
classpathref="class.path" />
83-
<!-- If you want to add files in the jars -->
84-
<copy todir="bin" overwrite="true" verbose="true">
85-
<fileset dir="src" includes="log4j2.xml" />
86-
</copy>
8783
</target>
8884

8985
<target name="test" depends="compile" description="Runs the test">

‎app/lib/log4j-api-2.16.0.jar

-295 KB
Binary file not shown.

‎app/lib/log4j-core-2.16.0.jar

-1.71 MB
Binary file not shown.

‎app/src/cc/arduino/contributions/ContributionsSelfCheck.java

+6-5
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@
3535
import cc.arduino.contributions.packages.ContributionInstaller;
3636
import cc.arduino.contributions.packages.filters.UpdatablePlatformPredicate;
3737
import cc.arduino.view.NotificationPopup;
38-
import org.apache.logging.log4j.LogManager;
3938
import processing.app.*;
4039

4140
import javax.swing.*;
@@ -160,12 +159,14 @@ public void windowGainedFocus(WindowEvent evt) {
160159

161160
private void goToManager(String link) {
162161
try {
163-
((UpdatableBoardsLibsFakeURLsHandler) hyperlinkListener).openBoardLibManager(new URL(link));
164-
}
165-
catch (Exception e){
166-
LogManager.getLogger(ContributionsSelfCheck.class).warn("Exception while attempting to go to board manager", e);
162+
((UpdatableBoardsLibsFakeURLsHandler) hyperlinkListener)
163+
.openBoardLibManager(new URL(link));
164+
} catch (Exception e) {
165+
System.err.println("Error while attempting to open board manager: "
166+
+ e.getMessage());
167167
}
168168
}
169+
169170
// callback for boards button
170171
public void onOptionalButton1Callback() {
171172
goToManager(boardsManagerURL);

‎app/src/log4j2.xml

-29
This file was deleted.

‎app/src/processing/app/Base.java

-6
Original file line numberDiff line numberDiff line change
@@ -220,12 +220,6 @@ public Base(String[] args) throws Exception {
220220
parser.parseArgumentsPhase1();
221221
commandLine = !parser.isGuiMode();
222222

223-
// This configure the logs root folder
224-
if (parser.isGuiMode()) {
225-
System.out.println("Set log4j store directory " + BaseNoGui.getSettingsFolder().getAbsolutePath());
226-
}
227-
System.setProperty("log4j.dir", BaseNoGui.getSettingsFolder().getAbsolutePath());
228-
229223
BaseNoGui.checkInstallationFolder();
230224

231225
// If no path is set, get the default sketchbook folder for this platform

‎arduino-core/.classpath

-2
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,6 @@
88
<classpathentry kind="lib" path="lib/jmdns-3.5.5.jar"/>
99
<classpathentry kind="lib" path="lib/slf4j-api-1.7.22.jar"/>
1010
<classpathentry kind="lib" path="lib/slf4j-simple-1.7.22.jar"/>
11-
<classpathentry kind="lib" path="lib/log4j-api-2.16.0.jar"/>
12-
<classpathentry kind="lib" path="lib/log4j-core-2.16.0.jar"/>
1311
<classpathentry kind="lib" path="lib/jsch-0.1.50.jar"/>
1412
<classpathentry kind="lib" path="lib/commons-exec-1.1.jar"/>
1513
<classpathentry kind="lib" path="../app/lib/commons-httpclient-3.1.jar"/>

‎arduino-core/lib/log4j-api-2.16.0.jar

-295 KB
Binary file not shown.

‎arduino-core/lib/log4j-core-2.16.0.jar

-1.71 MB
Binary file not shown.

‎arduino-core/src/cc/arduino/contributions/DownloadableContributionsDownloader.java

-18
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,6 @@
3434
import cc.arduino.utils.Progress;
3535
import cc.arduino.utils.network.FileDownloader;
3636
import org.apache.commons.io.FilenameUtils;
37-
import org.apache.logging.log4j.LogManager;
38-
import org.apache.logging.log4j.Logger;
3937
import processing.app.BaseNoGui;
4038
import processing.app.PreferencesData;
4139

@@ -48,8 +46,6 @@
4846
import static processing.app.I18n.tr;
4947

5048
public class DownloadableContributionsDownloader {
51-
private static Logger log = LogManager.getLogger(DownloadableContributionsDownloader.class);
52-
5349
private final File stagingFolder;
5450

5551
public DownloadableContributionsDownloader(File _stagingFolder) {
@@ -151,7 +147,6 @@ public void download(URL url, File tmpFile, Progress progress, String statusText
151147
}
152148

153149
public void downloadIndexAndSignature(MultiStepProgress progress, URL packageIndexUrl, ProgressListener progressListener, SignatureVerifier signatureVerifier) throws Exception {
154-
155150
// Extract the file name from the url
156151
final String indexFileName = FilenameUtils.getName(packageIndexUrl.getPath());
157152
final File packageIndex = BaseNoGui.indexer.getIndexFile(indexFileName);
@@ -169,16 +164,13 @@ public void downloadIndexAndSignature(MultiStepProgress progress, URL packageInd
169164
if (checkSignature(progress, signatureUrl, progressListener, signatureVerifier, statusText, packageIndexTemp)) {
170165
Files.move(packageIndexTemp.toPath(), packageIndex.toPath(), StandardCopyOption.REPLACE_EXISTING);
171166
} else {
172-
log.info("The cached files have been removed. {} {}", packageIndexUrl, signatureUrl);
173167
FileDownloader.invalidateFiles(packageIndexUrl, signatureUrl);
174168
}
175169
} else {
176170
// Move the package index to the destination when the signature is not necessary
177171
Files.move(packageIndexTemp.toPath(), packageIndex.toPath(), StandardCopyOption.REPLACE_EXISTING);
178-
log.info("The domain is not selected to verify the signature. will be copied into this path {}, packageIndex url: {}", packageIndex, packageIndexUrl);
179172
}
180173
} catch (Exception e) {
181-
log.error("Cannot download the package index from {} the package will be discard", packageIndexUrl, e);
182174
throw e;
183175
} finally {
184176
// Delete useless temp file
@@ -196,49 +188,39 @@ public boolean verifyDomain(URL url) {
196188
if (domain.contains(url.getHost())) {
197189
return true;
198190
} else {
199-
log.info("The domain is not selected to verify the signature. domain list: {}, url: {}", domain, url);
200191
return false;
201192
}
202193
}
203194

204195
public boolean checkSignature(MultiStepProgress progress, URL signatureUrl, ProgressListener progressListener, SignatureVerifier signatureVerifier, String statusText, File fileToVerify) throws Exception {
205-
206-
207196
// Signature file name
208197
final String signatureFileName = FilenameUtils.getName(signatureUrl.getPath());
209198
final File packageIndexSignature = BaseNoGui.indexer.getIndexFile(signatureFileName);
210199
final File packageIndexSignatureTemp = File.createTempFile(signatureFileName, ".tmp");
211200

212-
213201
try {
214202
// Download signature
215203
download(signatureUrl, packageIndexSignatureTemp, progress, statusText, progressListener, true);
216204

217205
if (PreferencesData.areInsecurePackagesAllowed()) {
218206
Files.move(packageIndexSignatureTemp.toPath(), packageIndexSignature.toPath(), StandardCopyOption.REPLACE_EXISTING);
219-
log.info("Allowing insecure packages because allow_insecure_packages is set to true in preferences.txt" +
220-
" but the signature was download");
221207
return true;
222208
}
223209

224210
// Verify the signature before move the files
225211
final boolean signatureVerified = signatureVerifier.isSigned(fileToVerify, packageIndexSignatureTemp);
226212
if (signatureVerified) {
227-
log.info("Signature verified. url={}, signature url={}, file to verify={}, signature file={}", signatureUrl, signatureUrl, fileToVerify, packageIndexSignatureTemp);
228213
// Move if the signature is ok
229214
Files.move(packageIndexSignatureTemp.toPath(), packageIndexSignature.toPath(), StandardCopyOption.REPLACE_EXISTING);
230215
} else {
231-
log.error("{} file signature verification failed. File ignored.", signatureUrl);
232216
System.err.println(format(tr("{0} file signature verification failed. File ignored."), signatureUrl.toString()));
233217
}
234218
return signatureVerified;
235219
} catch (Exception e) {
236-
log.error("Cannot download the signature from {} the package will be discard", signatureUrl, e);
237220
throw e;
238221
} finally {
239222
Files.deleteIfExists(packageIndexSignatureTemp.toPath());
240223
}
241-
242224
}
243225

244226
}

‎arduino-core/src/cc/arduino/contributions/libraries/LibraryInstaller.java

-7
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,6 @@
3838
import cc.arduino.utils.MultiStepProgress;
3939
import cc.arduino.utils.network.FileDownloader;
4040
import org.apache.commons.io.FilenameUtils;
41-
import org.apache.logging.log4j.LogManager;
42-
import org.apache.logging.log4j.Logger;
4341
import processing.app.BaseNoGui;
4442
import processing.app.I18n;
4543
import processing.app.Platform;
@@ -57,8 +55,6 @@
5755
import static processing.app.I18n.tr;
5856

5957
public class LibraryInstaller {
60-
private static Logger log = LogManager.getLogger(LibraryInstaller.class);
61-
6258
private final Platform platform;
6359
private final GPGDetachedSignatureVerifier signatureVerifier;
6460

@@ -97,10 +93,7 @@ public synchronized void updateIndex(ProgressListener progressListener) throws E
9793
}
9894
} else {
9995
FileDownloader.invalidateFiles(libraryGzURL, libraryURL, signatureUrl);
100-
log.error("Fail to verify the signature of {} the cached files have been removed", libraryURL);
10196
}
102-
} else {
103-
log.info("The domain is not selected to verify the signature. library index: {}", signatureUrl);
10497
}
10598

10699
// Step 2: Parse index

‎arduino-core/src/cc/arduino/contributions/packages/ContributionInstaller.java

-9
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,6 @@
4141
import org.apache.commons.exec.DefaultExecutor;
4242
import org.apache.commons.exec.Executor;
4343
import org.apache.commons.exec.PumpStreamHandler;
44-
import org.apache.logging.log4j.LogManager;
45-
import org.apache.logging.log4j.Logger;
4644
import processing.app.BaseNoGui;
4745
import processing.app.I18n;
4846
import processing.app.Platform;
@@ -64,8 +62,6 @@
6462
import static processing.app.I18n.tr;
6563

6664
public class ContributionInstaller {
67-
private static Logger log = LogManager.getLogger(ContributionInstaller.class);
68-
6965
private final Platform platform;
7066
private final SignatureVerifier signatureVerifier;
7167

@@ -271,8 +267,6 @@ public synchronized List<String> remove(ContributedPlatform contributedPlatform)
271267
Files.delete(destFolder.getParentFile().toPath());
272268
} catch (Exception e) {
273269
// ignore
274-
log.info("The directory is not empty there is another version installed. directory {}",
275-
destFolder.getParentFile().toPath(), e);
276270
}
277271
}
278272

@@ -298,15 +292,12 @@ public synchronized void updateIndex(ProgressListener progressListener) {
298292
// Extract the file name from the URL
299293
final URL packageIndexURL = new URL(packageIndexURLString);
300294

301-
log.info("Start download and signature check of={}", packageIndexURLs);
302295
downloader.downloadIndexAndSignature(progress, packageIndexURL, progressListener, signatureVerifier);
303296
} catch (Exception e) {
304-
log.error(e.getMessage(), e);
305297
System.err.println(e.getMessage());
306298
}
307299
}
308300

309301
progress.stepDone();
310-
log.info("Downloaded package index URL={}", packageIndexURLs);
311302
}
312303
}

‎arduino-core/src/cc/arduino/utils/network/FileDownloader.java

+5-22
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,6 @@
3030
package cc.arduino.utils.network;
3131

3232
import org.apache.commons.compress.utils.IOUtils;
33-
import org.apache.logging.log4j.LogManager;
34-
import org.apache.logging.log4j.Logger;
3533
import processing.app.helpers.FileUtils;
3634

3735
import javax.script.ScriptException;
@@ -50,8 +48,6 @@
5048
import java.util.Optional;
5149

5250
public class FileDownloader extends Observable {
53-
private static Logger log = LogManager.getLogger(FileDownloader.class);
54-
5551
public enum Status {
5652
CONNECTING, //
5753
CONNECTION_TIMEOUT_ERROR, //
@@ -146,17 +142,16 @@ public static void invalidateFiles(URL... filesUrl) {
146142
try {
147143
FileDownloaderCache.getFileCached(url).ifPresent(fileCached -> {
148144
try {
149-
log.info("Invalidate this file {} that comes from {}", fileCached.getLocalPath(), fileCached.getRemoteURL());
150145
fileCached.invalidateCache();
151146
} catch (Exception e) {
152-
log.warn("Fail to invalidate cache", e);
147+
System.err.println("Error invalidating cached file " + fileCached.getLocalPath() + " that comes from "
148+
+ fileCached.getRemoteURL() + ": " + e.getMessage());
153149
}
154150
});
155151
} catch (URISyntaxException | NoSuchMethodException | ScriptException | IOException e) {
156-
log.warn("Fail to get the file cached during the file invalidation", e);
152+
System.err.println("Fail to get the file cached during the file invalidation" + e.getMessage());
157153
}
158154
});
159-
160155
}
161156

162157
private void downloadFile(boolean noResume) throws InterruptedException {
@@ -171,7 +166,6 @@ private void downloadFile(boolean noResume) throws InterruptedException {
171166
final Optional<File> fileFromCache = getFileCached(fileCached);
172167
if (fileCached.isNotChange() && fileFromCache.isPresent()) {
173168
// Copy the cached file in the destination file
174-
log.info("The file will be taken from the cache {}", fileFromCache);
175169
FileUtils.copyFile(fileFromCache.get(), outputFile);
176170
} else {
177171
openConnectionAndFillTheFile(noResume);
@@ -191,34 +185,23 @@ private void downloadFile(boolean noResume) throws InterruptedException {
191185
} catch (SocketTimeoutException e) {
192186
setStatus(Status.CONNECTION_TIMEOUT_ERROR);
193187
setError(e);
194-
log.error("The request went in socket timeout", e);
195188

196189
} catch (Exception e) {
197190
setStatus(Status.ERROR);
198191
setError(e);
199-
log.error("The request stop", e);
200192
}
201193

202194
}
203195

204196
private Optional<File> getFileCached(FileDownloaderCache.FileCached fileCached) {
205-
206197
try {
207-
final Optional<File> fileFromCache =
208-
fileCached.getFileFromCache();
198+
final Optional<File> fileFromCache = fileCached.getFileFromCache();
209199
if (fileFromCache.isPresent()) {
210-
log.info("No need to download using cached file: {}", fileCached);
211200
return fileFromCache;
212-
} else {
213-
log.info(
214-
"The file in the cache is not in the path or the md5 validation failed: path={}, file exist={}, md5 validation={}",
215-
fileCached.getLocalPath(), fileCached.exists(), fileCached.md5Check());
216201
}
217202
} catch (Exception e) {
218-
log.warn(
219-
"Cannot get the file from the cache, will be downloaded a new one ", e);
203+
// Cannot get the file from the cache, download a new one
220204
}
221-
log.info("The file is change {}", fileCached);
222205
return Optional.empty();
223206
}
224207

0 commit comments

Comments
 (0)