Skip to content

fix: null-check LoggerDynamicMBean addAppender instantiation#4185

Open
SebTardif wants to merge 2 commits into
apache:2.xfrom
SebTardif:fix/logger-dynamic-mbean-null-appender
Open

fix: null-check LoggerDynamicMBean addAppender instantiation#4185
SebTardif wants to merge 2 commits into
apache:2.xfrom
SebTardif:fix/logger-dynamic-mbean-null-appender

Conversation

@SebTardif

Copy link
Copy Markdown
Contributor

LoggerDynamicMBean.addAppender (log4j-1.2-api JMX) calls OptionConverter.instantiateByClassName(..., null) and immediately uses the result. When the class name is invalid or not an Appender, instantiation returns null and the next line NPEs on appender.setName(...). That reaches the host through the JMX addAppender operation with a bad class name.

Failure scenario

// LoggerDynamicMBean.addAppender
final Appender appender =
    (Appender) OptionConverter.instantiateByClassName(appenderClass, Appender.class, null);
appender.setName(appenderName); // NPE when instantiate returns null

OptionConverter.instantiateByClassName already logs and returns the default (null) on ReflectiveOperationException or assignability failure. The JMX facade must treat that as "do not attach," not as a hard crash.

Fix

  • Null-check after instantiate; cat.error(...) and return without attaching.
  • Sibling audit: AppenderDynamicMBean.setLayout has the same instantiate pattern, but registerLayoutMBean already returns early when layout == null. No change needed there.

Red / green

# Without fix
./mvnw -pl log4j-1.2-api test \
  -Dtest=LoggerDynamicMBeanTest#addAppenderDoesNotNpeWhenClassCannotBeInstantiated \
  -Dsurefire.failIfNoSpecifiedTests=false
# FAIL: NPE at LoggerDynamicMBean.addAppender:70 setName on null

# With fix
./mvnw -pl log4j-1.2-api test -Dtest=LoggerDynamicMBeanTest \
  -Dsurefire.failIfNoSpecifiedTests=false
# PASS: Tests run: 2, Failures: 0

Also covers the happy path: valid ConsoleAppender class still attaches under the given name.

Checklist

  • Base branch: 2.x
  • Changelog: src/changelog/.2.x.x/fix_logger_dynamic_mbean_null_appender.xml
  • Tests: LoggerDynamicMBeanTest (JUnit 5, same package as package-private addAppender)
  • Spotless: ./mvnw spotless:check -pl log4j-1.2-api -am clean

Related: same null-from-instantiate class as #4172 (XmlConfiguration parseAppender).

OptionConverter.instantiateByClassName returns null when the class is
missing or not an Appender. addAppender immediately called setName and
NPE'd on invalid JMX addAppender class names. Skip attach and log an
error instead.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Development

Successfully merging this pull request may close these issues.

1 participant