Real CVEs: Log4Shell
InjectionIntermediateabout 35 minutes+51 -0
Click a line to select it, or press and drag down the changes to select a block (Shift-click works too). Then name the weakness and submit the finding. Each finding is marked as soon as you submit it. On the keyboard, Tab to a file's changes, move with the arrow keys, hold Shift to select a block, and press Enter to flag it.
| @@ -111,0 +111,30 @@ | |||
| 111 | + | @Override | |
|---|---|---|---|
| 112 | + | public void format(final LogEvent event, final StringBuilder toAppendTo) { | |
| 113 | + | final Message msg = event.getMessage(); | |
| 114 | + | if (msg instanceof StringBuilderFormattable) { | |
| 115 | + | ||
| 116 | + | final boolean doRender = textRenderer != null; | |
| 117 | + | final StringBuilder workingBuilder = doRender ? new StringBuilder(80) : toAppendTo; | |
| 118 | + | ||
| 119 | + | final int offset = workingBuilder.length(); | |
| 120 | + | if (msg instanceof MultiFormatStringBuilderFormattable) { | |
| 121 | + | ((MultiFormatStringBuilderFormattable) msg).formatTo(formats, workingBuilder); | |
| 122 | + | } else { | |
| 123 | + | ((StringBuilderFormattable) msg).formatTo(workingBuilder); | |
| 124 | + | } | |
| 125 | + | ||
| 126 | + | // TODO can we optimize this? | |
| 127 | + | if (config != null && !noLookups) { | |
| 128 | + | for (int i = offset; i < workingBuilder.length() - 1; i++) { | |
| 129 | + | if (workingBuilder.charAt(i) == '$' && workingBuilder.charAt(i + 1) == '{') { | |
| 130 | + | final String value = workingBuilder.substring(offset, workingBuilder.length()); | |
| 131 | + | workingBuilder.setLength(offset); | |
| 132 | + | workingBuilder.append(config.getStrSubstitutor().replace(event, value)); | |
| 133 | + | } | |
| 134 | + | } | |
| 135 | + | } | |
| 136 | + | if (doRender) { | |
| 137 | + | textRenderer.render(workingBuilder, toAppendTo); | |
| 138 | + | } | |
| 139 | + | return; | |
| 140 | + | } | |
| @@ -40,0 +40,2 @@ | |||
| 40 | + | /** JNDI resource path prefix used in a J2EE container */ | |
|---|---|---|---|
| 41 | + | static final String CONTAINER_JNDI_RESOURCE_PATH_PREFIX = "java:comp/env/"; | |
| @@ -49,0 +49,13 @@ | |||
| 49 | + | @Override | |
| 50 | + | public String lookup(final LogEvent event, final String key) { | |
| 51 | + | if (key == null) { | |
| 52 | + | return null; | |
| 53 | + | } | |
| 54 | + | final String jndiName = convertJndiName(key); | |
| 55 | + | try (final JndiManager jndiManager = JndiManager.getDefaultManager()) { | |
| 56 | + | return Objects.toString(jndiManager.lookup(jndiName), null); | |
| 57 | + | } catch (final NamingException e) { | |
| 58 | + | LOGGER.warn(LOOKUP, "Error looking up JNDI resource [{}].", jndiName, e); | |
| 59 | + | return null; | |
| 60 | + | } | |
| 61 | + | } | |
| @@ -70,0 +70,6 @@ | |||
| 70 | + | private String convertJndiName(final String jndiName) { | |
| 71 | + | if (!jndiName.startsWith(CONTAINER_JNDI_RESOURCE_PATH_PREFIX) && jndiName.indexOf(':') == -1) { | |
| 72 | + | return CONTAINER_JNDI_RESOURCE_PATH_PREFIX + jndiName; | |
| 73 | + | } | |
| 74 | + | return jndiName; | |
| 75 | + | } | |
This challenge is Training Content. We encourage you to discuss it and to publish your own write-ups and videos of it.