Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package logback for openSUSE:Factory checked in at 2026-06-27 18:06:10 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/logback (Old) and /work/SRC/openSUSE:Factory/.logback.new.11887 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "logback" Sat Jun 27 18:06:10 2026 rev:15 rq:1361884 version:1.5.36 Changes: -------- --- /work/SRC/openSUSE:Factory/logback/logback.changes 2026-06-12 19:29:10.330327441 +0200 +++ /work/SRC/openSUSE:Factory/.logback.new.11887/logback.changes 2026-06-27 18:07:46.155363931 +0200 @@ -1,0 +2,34 @@ +Fri Jun 26 05:56:46 UTC 2026 - Fridrich Strba <[email protected]> + +- Upgrade to upstream version 1.5.36 + * Changes of 1.5.36 + + The 'condition' attribute in <if> elements now reject certain + references that are associated with ACE attacks + (bsc#1269222, CVE-2026-13006). + * Changes of 1.5.35 + + The 'condition' attribute in <if> elements now rejects unicode + escape sequences (\u and \U). This closes a bypass of the + existing prohibition on the new operator in Janino-evaluated + conditions (bsc#1269222, CVE-2026-13006). Please note that the + version 1.5.36 provides the full fix to this vulnerability. + + Added ConfiguratorRank.AUTHENTICATING (rank 100), the highest + configurator rank, for certified/authenticating configurators + discovered via the ServiceLoader mechanism. ContextInitializer + now requires that at most one such configurator exist on the + classpath; if more than one is found, initialization aborts + with an error. + + ConsoleCharsetPropertyDefiner is no longer shipped. The Java + 21 multi-release compilation of logback-core has been + disabled, which removes this class from the published + artifact. Configurations that referenced + ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner + will need an alternative approach for console charset + detection. + + The logback-examples module is now included in the set of + artifacts published to Maven Central. + + JoranConfigurator.makeAnotherInstance() and + DefaultJoranConfigurator.performMultiStepConfigurationFileSearch() + are now protected, allowing derived configurators to override + these methods. + +------------------------------------------------------------------- Old: ---- logback-1.5.34.tar.xz New: ---- logback-1.5.36.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ logback.spec ++++++ --- /var/tmp/diff_new_pack.mfA5iA/_old 2026-06-27 18:07:46.935390345 +0200 +++ /var/tmp/diff_new_pack.mfA5iA/_new 2026-06-27 18:07:46.935390345 +0200 @@ -17,7 +17,7 @@ Name: logback -Version: 1.5.34 +Version: 1.5.36 Release: 0 Summary: A Java logging library License: EPL-1.0 OR LGPL-2.1-or-later @@ -115,10 +115,6 @@ %pom_xpath_set "pom:project/pom:properties/pom:slf4j.version" 2 -%if %{?pkg_vcmp:%pkg_vcmp java-devel < 21}%{!?pkg_vcmp:0} - %pom_xpath_remove "pom:executions/pom:execution[pom:id[text()='java21-compile']]" logback-core -%endif - %{mvn_package} ":%{name}-access" access %{mvn_package} ":%{name}-examples" examples ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.mfA5iA/_old 2026-06-27 18:07:46.975391700 +0200 +++ /var/tmp/diff_new_pack.mfA5iA/_new 2026-06-27 18:07:46.975391700 +0200 @@ -1,6 +1,6 @@ -mtime: 1781067571 -commit: 7610fec77ae473bc823cbf130b88ddbff85b95e358a96b48328a67902e3a9bd5 +mtime: 1782465148 +commit: 2e104f4ee0560a6a87bad46b6eadb4b34f85dd71c87a490ae6b3158f4d693cdb url: https://src.opensuse.org/java-packages/logback -revision: 7610fec77ae473bc823cbf130b88ddbff85b95e358a96b48328a67902e3a9bd5 +revision: 2e104f4ee0560a6a87bad46b6eadb4b34f85dd71c87a490ae6b3158f4d693cdb projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj ++++++ _service ++++++ --- /var/tmp/diff_new_pack.mfA5iA/_old 2026-06-27 18:07:46.999392513 +0200 +++ /var/tmp/diff_new_pack.mfA5iA/_new 2026-06-27 18:07:47.003392648 +0200 @@ -2,7 +2,7 @@ <service name="tar_scm" mode="disabled"> <param name="scm">git</param> <param name="url">https://github.com/qos-ch/logback.git</param> - <param name="revision">v_1.5.34</param> + <param name="revision">v_1.5.36</param> <param name="match-tag">v_*</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v_(.*)</param> ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-06-26 11:12:28.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ logback-1.5.34.tar.xz -> logback-1.5.36.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-access/pom.xml new/logback-1.5.36/logback-access/pom.xml --- old/logback-1.5.34/logback-access/pom.xml 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/logback-access/pom.xml 2026-06-25 21:10:00.000000000 +0200 @@ -8,7 +8,7 @@ <parent> <groupId>ch.qos.logback</groupId> <artifactId>logback-parent</artifactId> - <version>1.5.34</version> + <version>1.5.36</version> </parent> <artifactId>logback-access</artifactId> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-classic/pom.xml new/logback-1.5.36/logback-classic/pom.xml --- old/logback-1.5.34/logback-classic/pom.xml 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/logback-classic/pom.xml 2026-06-25 21:10:00.000000000 +0200 @@ -8,7 +8,7 @@ <parent> <groupId>ch.qos.logback</groupId> <artifactId>logback-parent</artifactId> - <version>1.5.34</version> + <version>1.5.36</version> </parent> <artifactId>logback-classic</artifactId> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-classic/src/main/java/ch/qos/logback/classic/joran/JoranConfigurator.java new/logback-1.5.36/logback-classic/src/main/java/ch/qos/logback/classic/joran/JoranConfigurator.java --- old/logback-1.5.34/logback-classic/src/main/java/ch/qos/logback/classic/joran/JoranConfigurator.java 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/logback-classic/src/main/java/ch/qos/logback/classic/joran/JoranConfigurator.java 2026-06-25 21:10:00.000000000 +0200 @@ -74,7 +74,7 @@ LogbackClassicDefaultNestedComponentRules.addDefaultNestedComponentRegistryRules(registry); } - private JoranConfigurator makeAnotherInstance() { + protected JoranConfigurator makeAnotherInstance() { JoranConfigurator jc = new JoranConfigurator(); jc.setContext(context); return jc; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-classic/src/main/java/ch/qos/logback/classic/spi/ConfiguratorRank.java new/logback-1.5.36/logback-classic/src/main/java/ch/qos/logback/classic/spi/ConfiguratorRank.java --- old/logback-1.5.34/logback-classic/src/main/java/ch/qos/logback/classic/spi/ConfiguratorRank.java 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/logback-classic/src/main/java/ch/qos/logback/classic/spi/ConfiguratorRank.java 2026-06-25 21:10:00.000000000 +0200 @@ -38,5 +38,7 @@ static public int CUSTOM_HIGH_PRIORITY = 40; static public int CUSTOM_TOP_PRIORITY = 50; + + static public int AUTHENTICATING = 100; public int value() default DEFAULT; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-classic/src/main/java/ch/qos/logback/classic/spi/LogbackServiceProvider.java new/logback-1.5.36/logback-classic/src/main/java/ch/qos/logback/classic/spi/LogbackServiceProvider.java --- old/logback-1.5.34/logback-classic/src/main/java/ch/qos/logback/classic/spi/LogbackServiceProvider.java 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/logback-classic/src/main/java/ch/qos/logback/classic/spi/LogbackServiceProvider.java 2026-06-25 21:10:00.000000000 +0200 @@ -72,13 +72,12 @@ } // contextSelectorBinder.init(defaultLoggerContext, KEY); - } catch (Exception t) { // see LOGBACK-1159 + } catch (Exception t) { // see LOGBACK-1159 -- do not swallow Errors Util.report("Failed to instantiate [" + LoggerContext.class.getName() + "]", t); } } @Override - public ILoggerFactory getLoggerFactory() { return defaultLoggerContext; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-classic/src/main/java/ch/qos/logback/classic/util/ContextInitializer.java new/logback-1.5.36/logback-classic/src/main/java/ch/qos/logback/classic/util/ContextInitializer.java --- old/logback-1.5.34/logback-classic/src/main/java/ch/qos/logback/classic/util/ContextInitializer.java 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/logback-classic/src/main/java/ch/qos/logback/classic/util/ContextInitializer.java 2026-06-25 21:10:00.000000000 +0200 @@ -40,7 +40,7 @@ public class ContextInitializer { /** - * @deprecated Please use ClassicConstants.AUTOCONFIG_FILE instead + * @deprecated Please use ClassicConstants.AUTOCONFIG_FILE instead */ final public static String AUTOCONFIG_FILE = ClassicConstants.AUTOCONFIG_FILE; /** @@ -87,6 +87,14 @@ printConfiguratorOrder(configuratorList); } + int authConfiguratorCount = authConfiguratorCount(configuratorList); + if (authConfiguratorCount > 1) { + contextAware.addError("Multiple custom configurators of rank AUTHENTICATING were discovered as a service. This is not allowed."); + contextAware.addError("Ensure that at most one AUTHENTICATING configurator exists on the classpath."); + return; + } + + // invoke custom configurators for (Configurator c : configuratorList) { if (invokeConfigure(c) == Configurator.ExecutionStatus.DO_NOT_INVOKE_NEXT_IF_ANY) return; @@ -94,21 +102,35 @@ // invoke internal configurators for (String configuratorClassName : INTERNAL_CONFIGURATOR_CLASSNAME_LIST) { - contextAware.addInfo("Trying to configure with "+configuratorClassName); + contextAware.addInfo("Trying to configure with " + configuratorClassName); Configurator c = instantiateConfiguratorByClassName(configuratorClassName, classLoader); - if(c == null) + if (c == null) continue; if (invokeConfigure(c) == Configurator.ExecutionStatus.DO_NOT_INVOKE_NEXT_IF_ANY) return; } } + private int authConfiguratorCount(List<Configurator> configuratorList) { + int count = 0; + for (Configurator c : configuratorList) { + if (c.getClass().getAnnotation(ConfiguratorRank.class) != null + && c.getClass().getAnnotation(ConfiguratorRank.class).value() == ConfiguratorRank.AUTHENTICATING) { + contextAware.addInfo("Configurator of rank AUTHENTICATING discovered: " + c.getClass().getName()); + count++; + + } + } + return count; + + } + private void checkVersions() { try { String coreVersion = CoreVersionUtil.getCoreVersionBySelfDeclaredProperties(); String classicVersion = ClassicVersionUtil.getVersionBySelfDeclaredProperties(); VersionUtil.checkForVersionEquality(loggerContext, coreVersion, classicVersion, "logback-core", "logback-classic"); - } catch(NoClassDefFoundError e) { + } catch (NoClassDefFoundError e) { contextAware.addWarn("Missing ch.logback.core.util.VersionUtil class on classpath. The version of logback-core is probably older than 1.5.26."); } catch (NoSuchMethodError e) { contextAware.addWarn(e.toString()); @@ -120,7 +142,7 @@ try { Class<?> classObj = classLoader.loadClass(configuratorClassName); return (Configurator) classObj.getConstructor().newInstance(); - } catch (ReflectiveOperationException e) { + } catch (ReflectiveOperationException e) { contextAware.addInfo("Instantiation failure: " + e.toString()); return null; } @@ -148,8 +170,8 @@ private void printConfiguratorOrder(List<Configurator> configuratorList) { contextAware.addInfo("Here is a list of configurators discovered as a service, by rank: "); - for(Configurator c: configuratorList) { - contextAware.addInfo(" "+c.getClass().getName()); + for (Configurator c : configuratorList) { + contextAware.addInfo(" " + c.getClass().getName()); } contextAware.addInfo("They will be invoked in order until ExecutionStatus.DO_NOT_INVOKE_NEXT_IF_ANY is returned."); } @@ -157,7 +179,7 @@ private void printDuration(long start, Configurator configurator, Configurator.ExecutionStatus executionStatus) { long end = System.currentTimeMillis(); long diff = end - start; - contextAware.addInfo( configurator.getClass().getName()+".configure() call lasted "+diff + " milliseconds. ExecutionStatus="+executionStatus); + contextAware.addInfo(configurator.getClass().getName() + ".configure() call lasted " + diff + " milliseconds. ExecutionStatus=" + executionStatus); } private Configurator.ExecutionStatus attemptConfigurationUsingJoranUsingReflexion(ClassLoader classLoader) { @@ -191,7 +213,7 @@ }; private int compareRankValue(int value1, int value2) { - if(value1 > value2) + if (value1 > value2) return 1; else if (value1 == value2) return 0; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-classic/src/main/java/ch/qos/logback/classic/util/DefaultJoranConfigurator.java new/logback-1.5.36/logback-classic/src/main/java/ch/qos/logback/classic/util/DefaultJoranConfigurator.java --- old/logback-1.5.34/logback-classic/src/main/java/ch/qos/logback/classic/util/DefaultJoranConfigurator.java 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/logback-classic/src/main/java/ch/qos/logback/classic/util/DefaultJoranConfigurator.java 2026-06-25 21:10:00.000000000 +0200 @@ -57,7 +57,7 @@ } } - private URL performMultiStepConfigurationFileSearch(boolean updateStatus) { + protected URL performMultiStepConfigurationFileSearch(boolean updateStatus) { ClassLoader myClassLoader = Loader.getClassLoaderOfObject(this); URL url = findConfigFileURLFromSystemProperties(myClassLoader, updateStatus); if (url != null) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-classic/src/test/input/issue/logback-1159.xml new/logback-1.5.36/logback-classic/src/test/input/issue/logback-1159.xml --- old/logback-1.5.34/logback-classic/src/test/input/issue/logback-1159.xml 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/logback-classic/src/test/input/issue/logback-1159.xml 2026-06-25 21:10:00.000000000 +0200 @@ -10,12 +10,11 @@ <appender name="JOURNAL" class="ch.qos.logback.core.rolling.RollingFileAppender"> - <file>target/test.log</file> + <file>${lltTargetDir}/test.log</file> <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy"> <!-- daily rollover --> - <fileNamePattern>target/test.${logback.rollingPattern}.log - </fileNamePattern> + <fileNamePattern>${lltTargetDir}/test.${logback.rollingPattern}.log</fileNamePattern> <maxHistory>30</maxHistory> </rollingPolicy> <encoder> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-classic/src/test/java/ch/qos/logback/classic/issue/logback1159/LogbackListenerTest.java new/logback-1.5.36/logback-classic/src/test/java/ch/qos/logback/classic/issue/logback1159/LogbackListenerTest.java --- old/logback-1.5.34/logback-classic/src/test/java/ch/qos/logback/classic/issue/logback1159/LogbackListenerTest.java 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/logback-classic/src/test/java/ch/qos/logback/classic/issue/logback1159/LogbackListenerTest.java 2026-06-25 21:10:00.000000000 +0200 @@ -26,28 +26,36 @@ //import org.apache.commons.io.FileUtils; //import org.apache.commons.lang3.RandomStringUtils; import ch.qos.logback.classic.util.LogbackMDCAdapter; +import ch.qos.logback.core.testUtil.FileTestUtil; +import ch.qos.logback.core.testUtil.RandomUtil; +import ch.qos.logback.core.util.FileUtil; import org.junit.jupiter.api.AfterEach; import org.junit.jupiter.api.Assertions; import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; import org.slf4j.Logger; import org.slf4j.LoggerFactory; -import org.slf4j.LoggerFactoryFriend; import ch.qos.logback.classic.LoggerContext; import ch.qos.logback.classic.joran.JoranConfigurator; import ch.qos.logback.core.joran.spi.JoranException; -import org.slf4j.spi.MDCAdapter; public class LogbackListenerTest { - private File logFile = new File("target/test.log"); + static String LLT_TARGET_DIR_KEY = "lltTargetDir"; + static String LLT_TARGET_DIR_PREFIX = "target/llt"; + + int diff = RandomUtil.getPositiveInt(); + private String lltTargetDirValue = LLT_TARGET_DIR_PREFIX+diff; + private File logFile = new File(lltTargetDirValue +"/test.log"); LoggerContext loggerContext = new LoggerContext(); LogbackMDCAdapter mdcAdapter = new LogbackMDCAdapter(); @BeforeEach void setUp() { + loggerContext.putProperty(LLT_TARGET_DIR_KEY, lltTargetDirValue); loggerContext.setMDCAdapter(mdcAdapter); + } private void doConfigure() throws JoranException { @@ -62,6 +70,7 @@ } private void disableLogFileAccess() throws IOException { + FileUtil.createMissingParentDirectories(logFile); logFile.createNewFile(); logFile.deleteOnExit(); Path path = Paths.get(logFile.toURI()); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-classic/src/test/java/ch/qos/logback/classic/joran/JoranConfiguratorTest.java new/logback-1.5.36/logback-classic/src/test/java/ch/qos/logback/classic/joran/JoranConfiguratorTest.java --- old/logback-1.5.34/logback-classic/src/test/java/ch/qos/logback/classic/joran/JoranConfiguratorTest.java 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/logback-classic/src/test/java/ch/qos/logback/classic/joran/JoranConfiguratorTest.java 2026-06-25 21:10:00.000000000 +0200 @@ -762,6 +762,7 @@ } + @Disabled @Test public void consoleCharsetTest() throws JoranException { if (EnvUtil.isJDK21OrHigher()) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-classic-blackbox/pom.xml new/logback-1.5.36/logback-classic-blackbox/pom.xml --- old/logback-1.5.34/logback-classic-blackbox/pom.xml 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/logback-classic-blackbox/pom.xml 2026-06-25 21:10:00.000000000 +0200 @@ -8,7 +8,7 @@ <parent> <groupId>ch.qos.logback</groupId> <artifactId>logback-parent</artifactId> - <version>1.5.34</version> + <version>1.5.36</version> </parent> <artifactId>logback-classic-blackbox</artifactId> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-classic-misc/pom.xml new/logback-1.5.36/logback-classic-misc/pom.xml --- old/logback-1.5.34/logback-classic-misc/pom.xml 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/logback-classic-misc/pom.xml 2026-06-25 21:10:00.000000000 +0200 @@ -8,7 +8,7 @@ <parent> <groupId>ch.qos.logback</groupId> <artifactId>logback-parent</artifactId> - <version>1.5.34</version> + <version>1.5.36</version> </parent> <artifactId>logback-classic-misc</artifactId> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-core/pom.xml new/logback-1.5.36/logback-core/pom.xml --- old/logback-1.5.34/logback-core/pom.xml 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/logback-core/pom.xml 2026-06-25 21:10:00.000000000 +0200 @@ -8,7 +8,7 @@ <parent> <groupId>ch.qos.logback</groupId> <artifactId>logback-parent</artifactId> - <version>1.5.34</version> + <version>1.5.36</version> </parent> <artifactId>logback-core</artifactId> @@ -105,6 +105,7 @@ </configuration> </execution> + <!-- <execution> <id>java21-compile</id> <phase>compile</phase> @@ -119,7 +120,7 @@ <multiReleaseOutput>true</multiReleaseOutput> </configuration> </execution> - + --> <execution> <id>default-testCompile</id> <phase>test-compile</phase> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-core/src/main/java/ch/qos/logback/core/model/processor/conditional/IfModelHandler.java new/logback-1.5.36/logback-core/src/main/java/ch/qos/logback/core/model/processor/conditional/IfModelHandler.java --- old/logback-1.5.34/logback-core/src/main/java/ch/qos/logback/core/model/processor/conditional/IfModelHandler.java 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/logback-core/src/main/java/ch/qos/logback/core/model/processor/conditional/IfModelHandler.java 2026-06-25 21:10:00.000000000 +0200 @@ -33,8 +33,12 @@ public static final String MISSING_JANINO_MSG = "Could not find Janino library on the class path. Skipping conditional processing."; public static final String MISSING_JANINO_SEE = "See also " + CoreConstants.CODES_URL + "#ifJanino"; - public static final String NEW_OPERATOR_DISALLOWED_MSG = "The 'condition' attribute may not contain the 'new' operator."; - public static final String NEW_OPERATOR_DISALLOWED_SEE = "See also " + CoreConstants.CODES_URL + "#conditionNew"; + public static final String BLACKLISTED_REF_DISALLOWED_MSG = "The 'condition' attribute may not contain blacklisted references."; + public static final String BLACKLISTED_REF_DISALLOWED_SEE = "See also " + CoreConstants.CODES_URL + "#conditionBlacklisted"; + + public static final String UNICODE_DISALLOWED_MSG = "The 'condition' attribute may not contain unicode escape characters."; + public static final String UNICODE_DISALLOWED_SEE = "See also " + CoreConstants.CODES_URL + "#conditionUnicode"; + public static final String CONDITION_ATTR_DEPRECATED_MSG = "The 'condition' attribute in <if> element is deprecated and slated for removal. Use <condition> element instead."; public static final String CONDITION_ATTR_DEPRECATED_SEE = "See also " + CoreConstants.CODES_URL + "#conditionAttributeDeprecation"; @@ -95,10 +99,16 @@ return; } + if(OptionHelper.containsUnicodeEscape(conditionStr)) { + addError(UNICODE_DISALLOWED_MSG); + addError(UNICODE_DISALLOWED_SEE); + return; + } + // do not allow 'new' operator - if(hasNew(conditionStr)) { - addError(NEW_OPERATOR_DISALLOWED_MSG); - addError(NEW_OPERATOR_DISALLOWED_SEE); + if(hasBlacklistedReferences(conditionStr)) { + addError(BLACKLISTED_REF_DISALLOWED_MSG); + addError(BLACKLISTED_REF_DISALLOWED_SEE); return; } @@ -124,6 +134,7 @@ } } + private void emitDeprecationWarningIfNecessary(String conditionStr) { if(!OptionHelper.isNullOrEmptyOrAllSpaces(conditionStr)) { addWarn(CONDITION_ATTR_DEPRECATED_MSG); @@ -132,8 +143,15 @@ } - private boolean hasNew(String conditionStr) { - return conditionStr.contains("new "); + static String[] BLACKLISTED_REFERENCES_IN_CONDITIONAL = new String[] {"new ", "Runtime", "springframework"}; + + static boolean hasBlacklistedReferences(String conditionStr) { + for (String fishyReference : BLACKLISTED_REFERENCES_IN_CONDITIONAL) { + if (conditionStr.contains(fishyReference)) { + return true; + } + } + return false; } @Override diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-core/src/main/java/ch/qos/logback/core/util/OptionHelper.java new/logback-1.5.36/logback-core/src/main/java/ch/qos/logback/core/util/OptionHelper.java --- old/logback-1.5.34/logback-core/src/main/java/ch/qos/logback/core/util/OptionHelper.java 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/logback-core/src/main/java/ch/qos/logback/core/util/OptionHelper.java 2026-06-25 21:10:00.000000000 +0200 @@ -315,6 +315,10 @@ return defaultVal; } + public static boolean containsUnicodeEscape(String value) { + return value.contains("\\u") || value.contains("\\U"); + } + /** * @deprecated * @since 1.3 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-core/src/test/java/ch/qos/logback/core/model/processor/conditional/IfModelHandlerTest.java new/logback-1.5.36/logback-core/src/test/java/ch/qos/logback/core/model/processor/conditional/IfModelHandlerTest.java --- old/logback-1.5.34/logback-core/src/test/java/ch/qos/logback/core/model/processor/conditional/IfModelHandlerTest.java 1970-01-01 01:00:00.000000000 +0100 +++ new/logback-1.5.36/logback-core/src/test/java/ch/qos/logback/core/model/processor/conditional/IfModelHandlerTest.java 2026-06-25 21:10:00.000000000 +0200 @@ -0,0 +1,18 @@ +package ch.qos.logback.core.model.processor.conditional; + +import org.junit.jupiter.api.Test; + +import static org.junit.jupiter.api.Assertions.assertFalse; +import static org.junit.jupiter.api.Assertions.assertTrue; + +public class IfModelHandlerTest { + + + @Test + public void testBlacklistedRefs() throws Exception { + assertFalse(IfModelHandler.hasBlacklistedReferences("true")); + assertTrue(IfModelHandler.hasBlacklistedReferences("new Integer(1)")); + assertTrue(IfModelHandler.hasBlacklistedReferences("org.springframework")); + assertTrue(IfModelHandler.hasBlacklistedReferences("java.lang.Runtime")); + } +} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-core/src/test/java/ch/qos/logback/core/util/OptionHelperTest.java new/logback-1.5.36/logback-core/src/test/java/ch/qos/logback/core/util/OptionHelperTest.java --- old/logback-1.5.34/logback-core/src/test/java/ch/qos/logback/core/util/OptionHelperTest.java 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/logback-core/src/test/java/ch/qos/logback/core/util/OptionHelperTest.java 2026-06-25 21:10:00.000000000 +0200 @@ -16,9 +16,7 @@ import static ch.qos.logback.core.subst.NodeToStringTransformer.CIRCULAR_VARIABLE_REFERENCE_DETECTED; import static ch.qos.logback.core.subst.Parser.EXPECTING_DATA_AFTER_LEFT_ACCOLADE; import static java.util.concurrent.TimeUnit.SECONDS; -import static org.junit.jupiter.api.Assertions.assertEquals; -import static org.junit.jupiter.api.Assertions.assertThrows; -import static org.junit.jupiter.api.Assertions.fail; +import static org.junit.jupiter.api.Assertions.*; import java.util.HashMap; import java.util.Map; @@ -392,4 +390,13 @@ assertEquals(input, r); } } + + @Test + public void containsUnicodeEscape() throws ScanException { + assertFalse(OptionHelper.containsUnicodeEscape("hello world")); + + assertTrue(OptionHelper.containsUnicodeEscape("hello \\u0077orld")); + assertTrue(OptionHelper.containsUnicodeEscape("hello \\\\U0001F600")); + + } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-core-blackbox/pom.xml new/logback-1.5.36/logback-core-blackbox/pom.xml --- old/logback-1.5.34/logback-core-blackbox/pom.xml 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/logback-core-blackbox/pom.xml 2026-06-25 21:10:00.000000000 +0200 @@ -8,7 +8,7 @@ <parent> <groupId>ch.qos.logback</groupId> <artifactId>logback-parent</artifactId> - <version>1.5.34</version> + <version>1.5.36</version> </parent> <artifactId>logback-core-blackbox</artifactId> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-core-blackbox/src/test/blackboxInput/joran/conditional/ifNewSlashU.xml new/logback-1.5.36/logback-core-blackbox/src/test/blackboxInput/joran/conditional/ifNewSlashU.xml --- old/logback-1.5.34/logback-core-blackbox/src/test/blackboxInput/joran/conditional/ifNewSlashU.xml 1970-01-01 01:00:00.000000000 +0100 +++ new/logback-1.5.36/logback-core-blackbox/src/test/blackboxInput/joran/conditional/ifNewSlashU.xml 2026-06-25 21:10:00.000000000 +0200 @@ -0,0 +1,14 @@ +<?xml version="1.0" encoding="UTF-8" ?> + +<x> + <stack name="BEGIN"/> + <if condition='n\u0067w Integer(1).equals(1)'> + <then> + <stack name="a"/> + </then> + <else> + <stack name="b"/> + </else> + </if> + <stack name="END"/> +</x> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-core-blackbox/src/test/java/ch/qos/logback/core/blackbox/joran/conditional/IfThenElseTest.java new/logback-1.5.36/logback-core-blackbox/src/test/java/ch/qos/logback/core/blackbox/joran/conditional/IfThenElseTest.java --- old/logback-1.5.34/logback-core-blackbox/src/test/java/ch/qos/logback/core/blackbox/joran/conditional/IfThenElseTest.java 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/logback-core-blackbox/src/test/java/ch/qos/logback/core/blackbox/joran/conditional/IfThenElseTest.java 2026-06-25 21:10:00.000000000 +0200 @@ -48,7 +48,6 @@ import ch.qos.logback.core.status.Status; import ch.qos.logback.core.status.StatusUtil; import ch.qos.logback.core.testUtil.RandomUtil; -import ch.qos.logback.core.util.StatusPrinter; import ch.qos.logback.core.util.StatusPrinter2; import org.junit.jupiter.api.AfterEach; import org.junit.jupiter.api.Assertions; @@ -60,6 +59,8 @@ import java.util.Stack; import java.util.function.Supplier; +import static org.junit.jupiter.api.Assertions.assertTrue; + public class IfThenElseTest { Context context = new ContextBase(); @@ -135,6 +136,8 @@ verifyConfig(new String[] { "BEGIN", "a", "END" }); } + + @Test public void whenContextPropertyIsSet_IfThenBranchIsEvaluated_WithoutJoran() throws JoranException { context.putProperty(ki1, val1); @@ -147,11 +150,23 @@ public void ifWithNew() throws JoranException { context.putProperty(ki1, val1); simpleConfigurator.doConfigure(CONDITIONAL_DIR_PREFIX + "ifNew.xml"); - checker.containsMatch(Status.ERROR, IfModelHandler.NEW_OPERATOR_DISALLOWED_MSG); - checker.containsMatch(Status.ERROR, IfModelHandler.NEW_OPERATOR_DISALLOWED_SEE); + assertTrue(checker.containsMatch(Status.ERROR, IfModelHandler.BLACKLISTED_REF_DISALLOWED_MSG)); + assertTrue(checker.containsMatch(Status.ERROR, IfModelHandler.BLACKLISTED_REF_DISALLOWED_SEE)); verifyConfig(new String[] { "BEGIN", "END" }); } + @Test + public void ifWithNewSlashU() throws JoranException { + context.putProperty(ki1, val1); + simpleConfigurator.doConfigure(CONDITIONAL_DIR_PREFIX + "ifNewSlashU.xml"); + assertTrue(checker.containsMatch(Status.ERROR, IfModelHandler.UNICODE_DISALLOWED_MSG)); + assertTrue(checker.containsMatch(Status.ERROR, IfModelHandler.UNICODE_DISALLOWED_SEE)); + // assertTrue(checker.containsMatch(Status.ERROR, IfModelHandler.NEW_OPERATOR_DISALLOWED_MSG)); + //assertTrue(checker.containsMatch(Status.ERROR, IfModelHandler.NEW_OPERATOR_DISALLOWED_SEE)); + verifyConfig(new String[] { "BEGIN", "END" }); + } + + // ---------------------------------------------------------------------------------------------------- @Test public void whenLocalPropertyIsSet_IfThenBranchIsEvaluated() throws JoranException { @@ -196,14 +211,14 @@ public void whenNoPropertyIsDefined_IfThenBranchIsNotEvaluated_NO_ELSE_DEFINED() throws JoranException { simpleConfigurator.doConfigure(CONDITIONAL_DIR_PREFIX + "ifWithoutElse.xml"); verifyConfig(new String[] { "BEGIN", "END" }); - Assertions.assertTrue(checker.isErrorFree(0)); + assertTrue(checker.isErrorFree(0)); } @Test public void whenNoPropertyIsDefined_IfThenBranchIsNotEvaluated_NO_ELSE_DEFINED_NoJoran() throws JoranException { simpleConfigurator.doConfigure(CONDITIONAL_DIR_PREFIX + "ifWithoutElse_NoJoran.xml"); verifyConfig(new String[] { "BEGIN", "END" }); - Assertions.assertTrue(checker.isErrorFree(0)); + assertTrue(checker.isErrorFree(0)); } // ---------------------------------------------------------------------------------------------------- @Test @@ -211,14 +226,14 @@ simpleConfigurator.doConfigure(CONDITIONAL_DIR_PREFIX + "nestedIf.xml"); //StatusPrinter.print(context); verifyConfig(new String[] { "BEGIN", "a", "c", "END" }); - Assertions.assertTrue(checker.isErrorFree(0)); + assertTrue(checker.isErrorFree(0)); } @Test public void nestedIf_NoJoran() throws JoranException { simpleConfigurator.doConfigure(CONDITIONAL_DIR_PREFIX + "nestedIf_NoJoran.xml"); //StatusPrinter.print(context); verifyConfig(new String[] { "BEGIN", "a", "c", "END" }); - Assertions.assertTrue(checker.isErrorFree(0)); + assertTrue(checker.isErrorFree(0)); } // ---------------------------------------------------------------------------------------------------- @Test diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/logback-examples/pom.xml new/logback-1.5.36/logback-examples/pom.xml --- old/logback-1.5.34/logback-examples/pom.xml 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/logback-examples/pom.xml 2026-06-25 21:10:00.000000000 +0200 @@ -8,7 +8,7 @@ <parent> <groupId>ch.qos.logback</groupId> <artifactId>logback-parent</artifactId> - <version>1.5.34</version> + <version>1.5.36</version> </parent> <artifactId>logback-examples</artifactId> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/logback-1.5.34/pom.xml new/logback-1.5.36/pom.xml --- old/logback-1.5.34/pom.xml 2026-06-01 10:47:41.000000000 +0200 +++ new/logback-1.5.36/pom.xml 2026-06-25 21:10:00.000000000 +0200 @@ -8,7 +8,7 @@ <groupId>ch.qos.logback</groupId> <artifactId>logback-parent</artifactId> - <version>1.5.34</version> + <version>1.5.36</version> <packaging>pom</packaging> <name>Logback-Parent</name> @@ -55,7 +55,7 @@ <properties> <!-- yyyy-MM-dd'T'HH:mm:ss'Z' --> - <project.build.outputTimestamp>2026-06-01T08:46:00Z</project.build.outputTimestamp> + <project.build.outputTimestamp>2026-06-25T19:09:00Z</project.build.outputTimestamp> <!-- minimal JDK version at runtime --> <jdk.version>11</jdk.version> @@ -473,7 +473,7 @@ <extensions>true</extensions> <configuration> <publishingServerId>central</publishingServerId> - <excludeArtifacts>logback-core-blackbox,logback-classic-misc,logback-classic-blackbox,logback-examples</excludeArtifacts> + <excludeArtifacts>logback-core-blackbox,logback-classic-misc,logback-classic-blackbox</excludeArtifacts> </configuration> </plugin>
