Comments (15)
Hi,
we will need a new version of FuelSDK-Java which supports the latest Apache Log4j.
Can salesforce-marketing-cloud update the FuelSDK-Java?
from fuelsdk-java.
Looks like it! Fuel SDK currently uses log4j version 1.2.17.
from fuelsdk-java.
This PR upgrades log4j
to the latest and safe version 2.16.0
and adjusts logger usage according to the newer API. I was not able to run all tests since they seem to have additional requirements towards the build/test environment.
from fuelsdk-java.
I did a bit more research. Apparently the mentioned vulnerability exists only for log4j versions between 2.0-beta9 and 2.16.0. However, version 1, as it is included here, is susceptible to other Remote Code Execution attacks! (source: https://www.lunasec.io/docs/blog/log4j-zero-day/#affected-apache-log4j-versions)
from fuelsdk-java.
I updated the PR to use the Log4j 1.2 API instead. This way, all we have to do is exchange the log4j dependency. All logger interactions stay the same. Thanks to @idealec for pointing this out to me!
from fuelsdk-java.
thanks @roechi for your review. I replaced log4j-1.2.17.jar with log4j-api-2.16.0.jar and log4j-1.2-api-2.16.0.jar in the classpath. It seemed that the new log4j 2.16.0 does not support Java 6. It causes the regression test to fail. Could you review it?
java.lang.UnsupportedClassVersionError: org/apache/log4j/Logger : Unsupported major.minor version 52.0
at java.lang.ClassLoader.defineClass1(Native Method)
at java.lang.ClassLoader.defineClassCond(ClassLoader.java:631)
at java.lang.ClassLoader.defineClass(ClassLoader.java:615)
at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:141)
at java.net.URLClassLoader.defineClass(URLClassLoader.java:283)
at java.net.URLClassLoader.access$000(URLClassLoader.java:58)
at java.net.URLClassLoader$1.run(URLClassLoader.java:197)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:190)
at java.lang.ClassLoader.loadClass(ClassLoader.java:306)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:301)
at java.lang.ClassLoader.loadClass(ClassLoader.java:247)
at com.exacttarget.fuelsdk.ETConfiguration.<clinit>(ETConfiguration.java:47)
from fuelsdk-java.
@kyleabcha the overview page of the Log4j 2 project states: As of Log4j 2.13.0 Log4j 2 requires Java 8 or greater at runtime.
(see: https://logging.apache.org/log4j/2.x/)
It does not seem like there is a legacy branch to keep up compatibility with older Java versions.
from fuelsdk-java.
FuelSDK-Java does support Java 6 compiler as it defined in pom file
<maven.compiler.source>1.6</maven.compiler.source>
<maven.compiler.target>1.6</maven.compiler.target>
Can FuelSDK-Java provide a workaround or a new patch that fixes Log4j 2 issue?
from fuelsdk-java.
I've forked the main branch and upgraded code to latest Apache Log4J and CXF as explained here:
#134 (comment)
Code is quite new however (just several hours old) and probably will have more than its share of problems.
from fuelsdk-java.
Hi all,
Thank you for your time and efforts.
@gmazza will your changes by any changes be merged with the main branch? We are also looking into having the FUELSDK updated in our project.
from fuelsdk-java.
@DennisAtDept I don't see SF acting on it. However, happy to note my branch seems to be working fine in production at work for the past few days.
from fuelsdk-java.
Hi @gmazza,
Thank you for all of your efforts, we tried out V1.6.0 of the FuelSDK-java but are encountering NoClassDeffFoundErrors when trying to use it.
[INFO] [talledLocalContainer] java.lang.NoClassDefFoundError: org/apache/log4j/Logger
[INFO] [talledLocalContainer] at com.exacttarget.fuelsdk.ETApiObject.(ETApiObject.java:61) ~[fuelsdk-1.6.0.jar:?]
Is seems like the FuelSDK still (at least partially) expect log4j1 to be present. Or are we missing something?
from fuelsdk-java.
Hi @DennisAtDept, the SF fork is different from mine, they're using separate code, if there are problems with it you may wish to open a new issue over it. But, for what it's worth, my fork seems to be working fine at work past couple of weeks now, and so I have no desire to go back to the main SF one: https://glenmazza.net/blog/entry/fork-of-fuelsdk-java-created
from fuelsdk-java.
Hi @gmazza,
Thanks for the reply I guess we will start using your form as well, build the project and include the artifact in our nexus.
Perhaps for others, might be cool to have your artifact available for the general public.
from fuelsdk-java.
I believe this has been fixed with v1.6.0.
from fuelsdk-java.
Related Issues (20)
- [BUG] FuelSdk is not compatible with Java 11 HOT 10
- [BUG] Issue updating ETAsset using client.update()
- [BUG]
- [Enhancement] Support PUT method for ETRestConnection
- Retrieve Automation Object
- Successfully execute update data extension row in SDK, but the row in SFMC is not updated.
- [BUG] ErrorCodeId is not present in the SubscriberResult in etframework.wsdl which is causing un-marsheling exceptions HOT 3
- [BUG] ETLClient createDataExtensionDataRow have too long size of the request headers for field User-Agent and request failed
- [BUG] High vulnerabilities found in org.apache.cxf_cxf-core version 3.1.2 HOT 1
- [BUG] Message xxxx is not valid for the client.
- [ISSUE] - Initiate ET client throwing Runtime modeler execption HOT 1
- Tenant's endpoint API integrations update HOT 1
- [BUG] CVE-2017-5645 - upgrade org.apache.logging.log4j:log4j-core to version 2.8.2 or higher HOT 1
- [Enhancement] - Replace log4j by a logging facade
- [BUG] variable [soap] is not assigned if variable [continueRequestId] is not null HOT 1
- [Enhancement] Expose Parent Id on ETFolder
- [Enhancement] Add support for Spring Boot 3 / add Jakarta-based artifact
- [Enhancement] - support java 17
- [BUG] Can't create Asset HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from fuelsdk-java.