Skip to content

Fix StatusLogger crash when property access is denied (#4429) - #4431

Closed
abhiramaab wants to merge 1 commit into
apache:2.xfrom
abhiramaab:fix-4429-status-logger-security-exception
Closed

abhiramaab wants to merge 1 commit into
apache:2.xfrom
abhiramaab:fix-4429-status-logger-security-exception

Conversation

@abhiramaab

Copy link
Copy Markdown

Description

StatusLogger.PropertiesUtilsDouble#readAllAvailableProperties directly called System.getProperties() and System.getenv() without handling SecurityException. When a SecurityManager denied access to system properties or environment variables, StatusLogger failed during static initialization, causing the Log4j API to crash on startup.

Fix

  • Wrapped System.getProperties() in a try-catch (SecurityException ignored) block in readSystemProperties(), falling back to an empty Properties instance.
  • Wrapped System.getenv() in a try-catch (SecurityException ignored) block in readEnvironmentProperties(), falling back to an empty Properties instance.
  • Added the regression test readAllAvailableProperties_should_not_fail_under_security_manager in StatusLoggerPropertiesUtilDoubleTest.

Closes #4429

Copilot AI balanced review requested due to automatic review settings October 25, 2026 12:35

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

@ramanathan1504

Copy link
Copy Markdown
Contributor

#4429 Suppressed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Development

Successfully merging this pull request may close these issues.

Fix StatusLogger crash when property access is denied

3 participants