是否有一个原因,为什么logback.groovy在1.2.9+中被丢弃?

djmepvbi  于 2022-11-21  发布在  其他
关注(0)|答案(1)|浏览(199)

我正在使用Logback和Slf 4j进行日志记录,配置以src/main/resources的形式出现在src/main/resources下,它总是像一个魅力。
我正准备将我的日志配置升级到可用的最新版本,却偶然发现了这个令人不快的问题。
依赖项ch.qos.logback:logback-classic:1.2.9显示警告:

Failed to instantiate [ch.qos.logback.classic.LoggerContext]
Reported exception:
ch.qos.logback.core.LogbackException: Unexpected filename extension of file [file:/[myproj]/build/resources/main/logback.groovy]. Should be either .groovy or .xml
    at ch.qos.logback.classic.util.ContextInitializer.configureByResource(ContextInitializer.java:67)
    at ch.qos.logback.classic.util.ContextInitializer.autoConfig(ContextInitializer.java:140)
    at org.slf4j.impl.StaticLoggerBinder.init(StaticLoggerBinder.java:84)
    ...

我检查了1.2.81.2.9的最新工作版本的ch.qos.logback.classic.util.ContextInitializer.configureByResource()代码:

// 1.2.8
    public void configureByResource(URL url) throws JoranException {
        if (url == null) {
            throw new IllegalArgumentException("URL argument cannot be null");
        }
        final String urlString = url.toString();
        if (urlString.endsWith("groovy")) {
            if (EnvUtil.isGroovyAvailable()) {
                // avoid directly referring to GafferConfigurator so as to avoid
                // loading groovy.lang.GroovyObject . See also http://jira.qos.ch/browse/LBCLASSIC-214
                GafferUtil.runGafferConfiguratorOn(loggerContext, this, url);
            } else {
                StatusManager sm = loggerContext.getStatusManager();
                sm.add(new ErrorStatus("Groovy classes are not available on the class path. ABORTING INITIALIZATION.", loggerContext));
            }
        } else if (urlString.endsWith("xml")) {
            JoranConfigurator configurator = new JoranConfigurator();
            configurator.setContext(loggerContext);
            configurator.doConfigure(url);
        } else {
            throw new LogbackException("Unexpected filename extension of file [" + url.toString() + "]. Should be either .groovy or .xml");
        }
    }

// 1.2.9
    public void configureByResource(URL url) throws JoranException {
        if (url == null) {
            throw new IllegalArgumentException("URL argument cannot be null");
        }
        final String urlString = url.toString();
        if (urlString.endsWith("xml")) {
            JoranConfigurator configurator = new JoranConfigurator();
            configurator.setContext(loggerContext);
            configurator.doConfigure(url);
        } else {
            throw new LogbackException("Unexpected filename extension of file [" + url.toString() + "]. Should be either .groovy or .xml");
        }
    }

因此,警告可能具有误导性,但代码更改是显而易见的:尽管ref-doc中没有提供“deprecation”警告,但Groovy支持已被删除。
为什么删除了groovy支持?
为什么没有引入“logback-groovy”包来提供支持?
Project's GitHub上没有“问题”部分,这很奇怪...

c8ib6hqw

c8ib6hqw1#

检查第4点:
https://logback.qos.ch/news.html#1.2.9
这是对CVE-2021-42550的回应
删除了Groovy配置支持。由于日志记录是如此普遍,并且Groovy配置可能过于强大,出于安全原因,不太可能恢复此功能。

相关问题