No longer allow arbitrary code to be executed from Log4j2
Trace Compass does not use Log4j2, but Log4j1, which is not
vulnerable. But this is a precaution to prevent other plugins
from other sources to be vulnerable.
Also fixes incubator
[Security] CVE-2021-44228
Change-Id: I0cd8f5860aaac25084424451e77b101dbca5b78b
Signed-off-by: Matthew Khouzam <matthew.khouzam@ericsson.com>
Reviewed-on: https://git.eclipse.org/r/c/tracecompass/org.eclipse.tracecompass/+/188336
Tested-by: Trace Compass Bot <tracecompass-bot@eclipse.org>
Tested-by: Bernd Hufmann <bernd.hufmann@ericsson.com>
Reviewed-by: Bernd Hufmann <bernd.hufmann@ericsson.com>
diff --git a/tmf/org.eclipse.tracecompass.tmf.core/src/org/eclipse/tracecompass/internal/tmf/core/Activator.java b/tmf/org.eclipse.tracecompass.tmf.core/src/org/eclipse/tracecompass/internal/tmf/core/Activator.java
index 41757a7..14cd9c0 100644
--- a/tmf/org.eclipse.tracecompass.tmf.core/src/org/eclipse/tracecompass/internal/tmf/core/Activator.java
+++ b/tmf/org.eclipse.tracecompass.tmf.core/src/org/eclipse/tracecompass/internal/tmf/core/Activator.java
@@ -91,6 +91,9 @@
@Override
public void start(BundleContext context) throws Exception {
super.start(context);
+ // CVE-2021-44228
+ System.setProperty("log4j2.formatMsgNoLookups", "true"); //$NON-NLS-1$ //$NON-NLS-2$
+ System.setProperty("log4j.formatMsgNoLookups", "true"); //$NON-NLS-1$ //$NON-NLS-2$
setDefault(this);
TmfCoreTracer.init();
/* Initialize the trace manager */
