This is an automated email from the ASF dual-hosted git repository. jacopoc pushed a commit to branch trunk in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit f9281d50d761985df6e207983433b093d5b701c7 Author: Jacopo Cappellato <[email protected]> AuthorDate: Thu Oct 1 08:04:41 2026 +0200 Handle IllegalArgumentException in Debug formatter It is good practice to never allow externally-controlled strings to be interpreted as format templates without validation. In a logging helper, safest is to attempt formatting only when appropriate and gracefully fall back to plain message output if the template is invalid. This fix doesn't break existing intended functionality: keep support for existing formatted log calls, but wrap formatter.format(msg, params) in a try/catch for IllegalArgumentException (covers IllegalFormatException and related formatter errors). On exception, fall back to logging the raw msg plus appended parameter values (non-format interpretation). This prevents format-string injection from causing exceptions while preserving normal formatting behavior for valid constant templates. Co-authored-by: Copilot Autofix --- .../base/src/main/java/org/apache/ofbiz/base/util/Debug.java | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/framework/base/src/main/java/org/apache/ofbiz/base/util/Debug.java b/framework/base/src/main/java/org/apache/ofbiz/base/util/Debug.java index 129047a467..d7d927bb93 100644 --- a/framework/base/src/main/java/org/apache/ofbiz/base/util/Debug.java +++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/Debug.java @@ -18,6 +18,7 @@ *******************************************************************************/ package org.apache.ofbiz.base.util; +import java.util.Arrays; import java.util.Formatter; import java.util.HashMap; import java.util.Locale; @@ -110,9 +111,14 @@ public final class Debug { if (msg != null && params.length > 0) { StringBuilder sb = new StringBuilder(); Formatter formatter = new Formatter(sb); - formatter.format(msg, params); - msg = sb.toString(); - formatter.close(); + try { + formatter.format(msg, params); + msg = sb.toString(); + } catch (IllegalArgumentException e) { + msg = msg + " " + Arrays.toString(params); + } finally { + formatter.close(); + } } // log
