This is an automated email from the ASF dual-hosted git repository. jacopoc pushed a commit to branch trunk in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 5cec81ca25521aa958df55918593766b01397fab Author: Jacopo Cappellato <[email protected]> AuthorDate: Thu Oct 1 10:19:32 2026 +0200 Fix CodeQL "Use of externally-controlled format string" alert in Debug CodeQL ignores the params.length > 0 check and does not treat the try/catch as a sanitizer. All the no-param log methods passed EMPTY_PARAMS into the varargs log(...), so any message reaching them was reported as flowing into Formatter.format(msg, params). Log methods without params now call a new private logMessage(...) method, which logs the message as is and never uses Formatter. Only calls that actually pass params reach the formatter, and all of those use constant format strings. Behaviour does not change, because messages without params were never formatted. The unused EMPTY_PARAMS constant is removed. Co-Authored-By: Claude Opus 5.5 --- .../java/org/apache/ofbiz/base/util/Debug.java | 72 ++++++++++++---------- 1 file changed, 38 insertions(+), 34 deletions(-) diff --git a/framework/base/src/main/java/org/apache/ofbiz/base/util/Debug.java b/framework/base/src/main/java/org/apache/ofbiz/base/util/Debug.java index d7d927bb93..a12c321020 100644 --- a/framework/base/src/main/java/org/apache/ofbiz/base/util/Debug.java +++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/Debug.java @@ -37,7 +37,6 @@ import org.apache.logging.log4j.spi.ExtendedLogger; public final class Debug { private static final String NO_MODULE = "NoModule"; // set to null for previous behavior - private static final Object[] EMPTY_PARAMS = new Object[0]; public static final int ALWAYS = 0; public static final int VERBOSE = 1; @@ -95,7 +94,9 @@ public final class Debug { } public static void log(int level, Throwable t, String msg, String module) { - log(level, t, msg, module, "org.apache.ofbiz.base.util.Debug", EMPTY_PARAMS); + if (isOn(level)) { + logMessage(level, t, msg, module); + } } public static void log(int level, Throwable t, String msg, String module, Object... params) { @@ -103,7 +104,7 @@ public final class Debug { } public static void log(int level, Throwable t, String msg, String module, String callingClass) { - log(level, t, msg, module, callingClass, new Object[0]); + log(level, t, msg, module); } public static void log(int level, Throwable t, String msg, String module, String callingClass, Object... params) { @@ -120,21 +121,24 @@ public final class Debug { formatter.close(); } } - - // log - ExtendedLogger logger = (ExtendedLogger) getLogger(module); - logger.logMessage(Debug.class.getName(), LEVEL_OBJS[level], null, - logger.getMessageFactory().newMessage(msg != null ? msg : ""), t); + logMessage(level, t, msg, module); } } + /** Logs the message as is, without interpreting it as a format string */ + private static void logMessage(int level, Throwable t, String msg, String module) { + ExtendedLogger logger = (ExtendedLogger) getLogger(module); + logger.logMessage(Debug.class.getName(), LEVEL_OBJS[level], null, + logger.getMessageFactory().newMessage(msg != null ? msg : ""), t); + } + public static boolean isOn(int level) { return LEVEL_ON_CACHE[level]; } // leaving these here public static void log(String msg) { - log(Debug.ALWAYS, null, msg, NO_MODULE, EMPTY_PARAMS); + log(Debug.ALWAYS, null, msg, NO_MODULE); } public static void log(String msg, Object... params) { @@ -142,11 +146,11 @@ public final class Debug { } public static void log(Throwable t) { - log(Debug.ALWAYS, t, null, NO_MODULE, EMPTY_PARAMS); + log(Debug.ALWAYS, t, null, NO_MODULE); } public static void log(String msg, String module) { - log(Debug.ALWAYS, null, msg, module, EMPTY_PARAMS); + log(Debug.ALWAYS, null, msg, module); } public static void log(String msg, String module, Object... params) { @@ -154,11 +158,11 @@ public final class Debug { } public static void log(Throwable t, String module) { - log(Debug.ALWAYS, t, null, module, EMPTY_PARAMS); + log(Debug.ALWAYS, t, null, module); } public static void log(Throwable t, String msg, String module) { - log(Debug.ALWAYS, t, msg, module, EMPTY_PARAMS); + log(Debug.ALWAYS, t, msg, module); } public static void log(Throwable t, String msg, String module, Object... params) { @@ -170,7 +174,7 @@ public final class Debug { } public static void logVerbose(String msg, String module) { - log(Debug.VERBOSE, null, msg, module, EMPTY_PARAMS); + log(Debug.VERBOSE, null, msg, module); } public static void logVerbose(String msg, String module, Object... params) { @@ -178,11 +182,11 @@ public final class Debug { } public static void logVerbose(Throwable t, String module) { - log(Debug.VERBOSE, t, null, module, EMPTY_PARAMS); + log(Debug.VERBOSE, t, null, module); } public static void logVerbose(Throwable t, String msg, String module) { - log(Debug.VERBOSE, t, msg, module, EMPTY_PARAMS); + log(Debug.VERBOSE, t, msg, module); } public static void logVerbose(Throwable t, String msg, String module, Object... params) { @@ -194,7 +198,7 @@ public final class Debug { } public static void logTiming(String msg, String module) { - log(Debug.TIMING, null, msg, module, EMPTY_PARAMS); + log(Debug.TIMING, null, msg, module); } public static void logTiming(String msg, String module, Object... params) { @@ -202,11 +206,11 @@ public final class Debug { } public static void logTiming(Throwable t, String module) { - log(Debug.TIMING, t, null, module, EMPTY_PARAMS); + log(Debug.TIMING, t, null, module); } public static void logTiming(Throwable t, String msg, String module) { - log(Debug.TIMING, t, msg, module, EMPTY_PARAMS); + log(Debug.TIMING, t, msg, module); } public static void logTiming(Throwable t, String msg, String module, Object... params) { @@ -218,7 +222,7 @@ public final class Debug { } public static void logInfo(String msg, String module) { - log(Debug.INFO, null, msg, module, EMPTY_PARAMS); + log(Debug.INFO, null, msg, module); } public static void logInfo(String msg, String module, Object... params) { @@ -226,11 +230,11 @@ public final class Debug { } public static void logInfo(Throwable t, String module) { - log(Debug.INFO, t, null, module, EMPTY_PARAMS); + log(Debug.INFO, t, null, module); } public static void logInfo(Throwable t, String msg, String module) { - log(Debug.INFO, t, msg, module, EMPTY_PARAMS); + log(Debug.INFO, t, msg, module); } public static void logInfo(Throwable t, String msg, String module, Object... params) { @@ -242,7 +246,7 @@ public final class Debug { } public static void logImportant(String msg, String module) { - log(Debug.IMPORTANT, null, msg, module, EMPTY_PARAMS); + log(Debug.IMPORTANT, null, msg, module); } public static void logImportant(String msg, String module, Object... params) { @@ -250,11 +254,11 @@ public final class Debug { } public static void logImportant(Throwable t, String module) { - log(Debug.IMPORTANT, t, null, module, EMPTY_PARAMS); + log(Debug.IMPORTANT, t, null, module); } public static void logImportant(Throwable t, String msg, String module) { - log(Debug.IMPORTANT, t, msg, module, EMPTY_PARAMS); + log(Debug.IMPORTANT, t, msg, module); } public static void logImportant(Throwable t, String msg, String module, Object... params) { @@ -266,7 +270,7 @@ public final class Debug { } public static void logWarning(String msg, String module) { - log(Debug.WARNING, null, msg, module, EMPTY_PARAMS); + log(Debug.WARNING, null, msg, module); } public static void logWarning(String msg, String module, Object... params) { @@ -274,11 +278,11 @@ public final class Debug { } public static void logWarning(Throwable t, String module) { - log(Debug.WARNING, t, null, module, EMPTY_PARAMS); + log(Debug.WARNING, t, null, module); } public static void logWarning(Throwable t, String msg, String module) { - log(Debug.WARNING, t, msg, module, EMPTY_PARAMS); + log(Debug.WARNING, t, msg, module); } public static void logWarning(Throwable t, String msg, String module, Object... params) { @@ -290,7 +294,7 @@ public final class Debug { } public static void logError(String msg, String module) { - log(Debug.ERROR, null, msg, module, EMPTY_PARAMS); + log(Debug.ERROR, null, msg, module); } public static void logError(String msg, String module, Object... params) { @@ -298,11 +302,11 @@ public final class Debug { } public static void logError(Throwable t, String module) { - log(Debug.ERROR, t, null, module, EMPTY_PARAMS); + log(Debug.ERROR, t, null, module); } public static void logError(Throwable t, String msg, String module) { - log(Debug.ERROR, t, msg, module, EMPTY_PARAMS); + log(Debug.ERROR, t, msg, module); } public static void logError(Throwable t, String msg, String module, Object... params) { @@ -314,7 +318,7 @@ public final class Debug { } public static void logFatal(String msg, String module) { - log(Debug.FATAL, null, msg, module, EMPTY_PARAMS); + log(Debug.FATAL, null, msg, module); } public static void logFatal(String msg, String module, Object... params) { @@ -322,11 +326,11 @@ public final class Debug { } public static void logFatal(Throwable t, String module) { - log(Debug.FATAL, t, null, module, EMPTY_PARAMS); + log(Debug.FATAL, t, null, module); } public static void logFatal(Throwable t, String msg, String module) { - log(Debug.FATAL, t, msg, module, EMPTY_PARAMS); + log(Debug.FATAL, t, msg, module); } public static void logFatal(Throwable t, String msg, String module, Object... params) {
