This is an automated email from the ASF dual-hosted git repository. FreeAndNil pushed a commit to branch Feature/security-audit-hardening in repository https://gitbox.apache.org/repos/asf/logging-log4net.git
commit 287fa9cd044f15bf8ccd5ef8e04caa748e91fb59 Author: Jan Friedrich <[email protected]> AuthorDate: Mon Aug 17 23:16:27 2026 +0200 document that format strings are trusted developer input Composite formatting honours the alignment of a format item before anything can reject it, so a format such as "{0,2000000000}" allocates a buffer of that size, and the OutOfMemoryException is fatal and escapes the catch that otherwise turns a bad format into an error string. Security scans report this, so record why it is not guarded against, with a link to the threat model. Format strings are developer-controlled and trusted, and routing user data into one is application misuse. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --- src/log4net/Util/SystemStringFormat.cs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/log4net/Util/SystemStringFormat.cs b/src/log4net/Util/SystemStringFormat.cs index 0d19571e..68121368 100644 --- a/src/log4net/Util/SystemStringFormat.cs +++ b/src/log4net/Util/SystemStringFormat.cs @@ -82,7 +82,10 @@ public sealed class SystemStringFormat(IFormatProvider? provider, string format, return format; } - // Try to format the string + // An alignment such as "{0,2000000000}" allocates before anything can reject it, and the + // OutOfMemoryException is fatal and escapes the catch below. Not guarded against: the format + // string is trusted developer input, see + // https://raw.githubusercontent.com/apache/logging-site/refs/heads/main/src/site/antora/modules/ROOT/pages/_threat-model-common.adoc return string.Format(provider, format, args); } catch (Exception e) when (!e.IsFatal())
