This is an automated email from the ASF dual-hosted git repository. FreeAndNil pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/logging-log4net.git
commit 71c038c1860b331ca944840702d72da53e4cb41f Merge: e3246a54 843ccfc1 Author: Jan Friedrich <[email protected]> AuthorDate: Tue Aug 18 15:03:45 2026 +0200 Harden log4net against the findings of a security audit Appenders: network and transport - 2fb4539f time out writes to stalled TelnetAppender clients - 15d16eed add a listen address to TelnetAppender - bd35fe0d add a TransportSecurity option to the MailKit SmtpAppender Appenders: syslog record integrity - eccb876e escape NUL characters in LocalSyslogAppender messages - 46582e52 report a RemoteSyslogAppender Identity that would split the record - 360a1026 fix the lifetime of the LocalSyslogAppender identity AdoNet appender - 9f5c9557 contain per-event failures in AdoNetAppender.SendBuffer - 19fdb4a2 warn when AdoNetAppender executes layout-generated SQL - e80b3810 redact the password when reporting a failed database connection Reliability and resource bounds - 3fd97cb5 bound the waits for the file locking mutexes - 394fd3dc bound regular expression matching in the string match filters - 86ecb152 flush TextWriterAppender under the appender lock - 1786b139 keep the impersonated user name when a logging event is fixed Diagnostics - ecd1b8b9 report the first appender error without log4net.Internal.Debug Build and release infrastructure - 9cc34d29 make the release verification scripts fail closed - 28d411a5 pin the Maven wrapper and distribution downloads - e203b7c7 remove the git-broadcast workflow Documentation - 6bc3df34 document that configuration is trusted input - 287fa9cd document that format strings are trusted developer input - dc17e1ba document the conventions the security scan work relied on (#309) Notes for reviewers Several commits introduce secure defaults with a named opt-out (SendTimeoutMillis, MatchTimeoutMillis, LockTimeoutMillis); those are behaviour changes on upgrade and are recorded in the changelog. The documentation commits deliberately settle recurring reports in the threat model rather than changing code. .github/workflows/git-broadcast.yml | 44 ----- .mvn/wrapper/maven-wrapper.properties | 7 + AGENTS.md | 24 ++- CLAUDE.md | 92 +++++++-- scripts/verify-release.ps1 | 78 +++++--- scripts/verify-release.sh | 50 ++++- src/changelog/3.4.0/310-bound-file-lock-waits.xml | 17 ++ .../3.4.0/310-bound-filter-regex-matching.xml | 17 ++ .../310-contain-per-event-adonet-failures.xml | 15 ++ .../310-escape-nul-in-local-syslog-messages.xml | 14 ++ .../3.4.0/310-flush-uses-the-appender-lock.xml | 15 ++ .../3.4.0/310-pin-maven-wrapper-checksums.xml | 14 ++ ...redact-password-in-connection-string-errors.xml | 13 ++ .../3.4.0/310-remove-git-broadcast-workflow.xml | 13 ++ .../310-report-first-appender-error-by-default.xml | 14 ++ .../3.4.0/310-report-malformed-syslog-identity.xml | 15 ++ .../310-require-tls-when-enablessl-is-set.xml | 15 ++ .../3.4.0/310-syslog-identity-lifetime.xml | 15 ++ .../3.4.0/310-telnet-appender-send-timeout.xml | 15 ++ src/changelog/3.4.0/310-telnet-listen-address.xml | 13 ++ .../3.4.0/310-username-honours-the-fix-gate.xml | 16 ++ .../3.4.0/310-verify-release-fails-closed.xml | 16 ++ .../3.4.0/310-warn-about-layout-generated-sql.xml | 13 ++ .../Appender/SmtpAppenderTest.cs | 76 +++++++- src/log4net.Ext.Mail/Appender/SmtpAppender.cs | 75 +++++-- .../Appender/SmtpTransportSecurity.cs | 79 ++++++++ .../Appender/AdoNet/Log4NetCommand.cs | 58 ++++++ .../Appender/AdoNet/Log4NetConnection.cs | 33 +++- .../Appender/AdoNet/Log4NetTransaction.cs | 16 +- src/log4net.Tests/Appender/AdoNetAppenderTest.cs | 156 +++++++++++++++ src/log4net.Tests/Appender/FileAppenderTest.cs | 84 +++++++- .../Appender/LocalSyslogAppenderTest.cs | 121 ++++++++++++ .../Appender/RemoteSyslogAppenderTest.cs | 71 ++++++- src/log4net.Tests/Appender/TelnetAppenderTest.cs | 79 ++++++++ .../Appender/TextWriterAppenderTest.cs | 116 +++++++++++ src/log4net.Tests/Core/FixingTest.cs | 99 +++++++++- src/log4net.Tests/Core/UserNameFixingTest.cs | 43 ++++ src/log4net.Tests/Filter/StringMatchFilterTest.cs | 128 ++++++++++++ src/log4net.Tests/Util/OnlyOnceErrorHandlerTest.cs | 121 ++++++++++++ src/log4net/Appender/AdoNetAppender.cs | 216 ++++++++++++++++++--- src/log4net/Appender/FileAppender.cs | 55 +++++- src/log4net/Appender/LocalSyslogAppender.cs | 80 ++++++-- src/log4net/Appender/RemoteSyslogAppender.cs | 60 +++++- src/log4net/Appender/RollingFileAppender.cs | 64 +++++- src/log4net/Appender/TelnetAppender.cs | 119 +++++++++++- src/log4net/Appender/TextWriterAppender.cs | 25 ++- src/log4net/Config/XmlConfigurator.cs | 18 ++ src/log4net/Core/LoggingEvent.cs | 68 ++++++- src/log4net/Filter/PropertyFilter.cs | 2 +- src/log4net/Filter/StringMatchFilter.cs | 87 ++++++++- .../Hierarchy/XmlHierarchyConfigurator.cs | 5 + src/log4net/Util/OnlyOnceErrorHandler.cs | 9 +- src/log4net/Util/SystemStringFormat.cs | 5 +- src/site/antora/modules/ROOT/nav.adoc | 1 + .../ROOT/pages/manual/configuration/appenders.adoc | 3 +- .../configuration/appenders/adonetappender.adoc | 14 +- .../configuration/appenders/fileappender.adoc | 34 +++- .../configuration/appenders/smtpappender.adoc | 58 +++++- .../configuration/appenders/telnetappender.adoc | 98 ++++++++++ .../ROOT/pages/manual/configuration/filters.adoc | 23 +++ 60 files changed, 2746 insertions(+), 198 deletions(-)
