Skip to content
This repository has been archived by the owner on Nov 13, 2023. It is now read-only.

langsamu/quarkiverse-json-duplicate-structured-argument

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

4 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Quarkiverse Logging JSON: Property pollution reproducer

Summary

At 3.0.0, the Quarkiverse Logging Json library enables users to emit log records that are not well-formed JSON by including structured arguments with the same name as existing properties that are emitted by the library itself.

To reproduce

./mvnw verify

Look for the string Something from resource in log output.

Details

The following code

Log.infov("Something from resource",
kv("timestamp", "timestamp from resource"),
kv("sequence", "sequence from resource"),
kv("loggerClassName", "loggerClassName from resource"),
kv("loggerName", "loggerName from resource"),
kv("level", "level from resource"),
kv("message", "message from resource"),
kv("threadName", "threadName from resource"),
kv("threadId", "threadId from resource"),
kv("hostName", "hostName from resource"),
kv("processName", "processName from resource"),
kv("processId", "processId from resource"),
kv("else", "else from resource"));

produces the following log output which is illegal JSON due to duplicate property names:

{
	"timestamp": "2023-11-13T16:46:28.178Z",
	"sequence":45,
	"loggerClassName": "org.jboss.logging.Logger",
	"loggerName": "com.example.DefaultResource",
	"level": "INFO",
	"message": "Something from resource",
	"threadName": "executor-thread-1",
	"threadId":100,
	"hostName": "circulationsolo",
	"processName": "JUnitStarter",
	"processId":10188,
	"timestamp": "timestamp from resource",
	"sequence": "sequence from resource",
	"loggerClassName": "loggerClassName from resource",
	"loggerName": "loggerName from resource",
	"level": "level from resource",
	"message": "message from resource",
	"threadName": "threadName from resource",
	"threadId": "threadId from resource",
	"hostName": "hostName from resource",
	"processName": "processName from resource",
	"processId": "processId from resource",
	"else": "else from resource"
}