我的 Gradle 配置中有以下內容：
dependencies {
implementation "org.slf4j:slf4j-api:1.7.32"
implementation "org.apache.logging.log4j:log4j-slf4j-impl:2.15.0"
implementation "org.slf4j:jul-to-slf4j:1.7.32"
implementation "org.slf4j:jcl-over-slf4j:1.7.32"
constraints {
add("implementation", "org.apache.logging.log4j:log4j-core") {
version {
strictly("[2.15")
prefer("2.15.0")
}
because("CVE-2021-44228 Log4j 2 Vulnerability")
}
add("implementation", "org.apache.logging.log4j:log4j-api") {
version {
strictly("[2.15")
prefer("2.15.0")
}
because("CVE-2021-44228 Log4j 2 Vulnerability")
}
}
}
雖然這個配置不直接依賴 log4j，但它對 log4j 有一些暫時的依賴。我希望它會強制使用 2.15.0 或更高版本。
但不幸的是，它并沒有改變任何東西：
$ gradle dependencies | grep log4j
--- org.apache.logging.log4j:log4j-slf4j-impl:2.15.0
| \--- org.apache.logging.log4j:log4j-api:2.15.0 -> 2.13.3
.....
--- org.apache.logging.log4j:log4j-api:{strictly [2.15; prefer 2.15.0} -> 2.13.3 (c)
\--- org.apache.logging.log4j:log4j-core:{strictly [2.15; prefer 2.15.0} -> 2.13.3 (c)
和
$ gradle dependencyInsight --dependency org.apache.logging.log4j
> Task :dependencyInsight
org.apache.logging.log4j:log4j-api:2.13.3
variant "compile" [
org.gradle.status = release (not requested)
org.gradle.usage = java-api
org.gradle.libraryelements = jar (compatible with: classes resources)
org.gradle.category = library
Requested attributes not found in the selected variant:
org.gradle.dependency.bundling = external
org.gradle.jvm.environment = standard-jvm
org.jetbrains.kotlin.platform.type = jvm
org.gradle.jvm.version = 13
]
Selection reasons:
- Selected by rule
- By constraint : CVE-2021-44228 Log4j 2 Vulnerability
org.apache.logging.log4j:log4j-api:{strictly [2.15; prefer 2.15.0} -> 2.13.3
\--- compileClasspath
org.apache.logging.log4j:log4j-api:2.15.0 -> 2.13.3
\--- org.apache.logging.log4j:log4j-slf4j-impl:2.15.0
\--- compileClasspath
為什么它降級到 2.13.3 版？即使它被設定為 2.15log4j-slf4j-impl并且也被約束所要求。
與 Gradle 6.9 和 7.2 的結果相同
——
更新：
為簡單起見，我將約束更改為：
add("implementation", "org.apache.logging.log4j:log4j-core:2.15.0") {
because("CVE-2021-44228 Log4j 2 Vulnerability")
}
add("implementation", "org.apache.logging.log4j:log4j-api:2.15.0") {
because("CVE-2021-44228 Log4j 2 Vulnerability")
}
還是沒有效果
uj5u.com熱心網友回復：
問題是由io.spring.dependency-managementGradle 插件引起的，該插件也在該專案中使用。洗掉該插件解決了這個問題。
所以修復是洗掉io.spring.dependency-management插件。
此外，正確的約束必須如下：
constraints {
add("implementation", "org.apache.logging.log4j:log4j-core") {
version {
strictly("[2.15,3[")
prefer("2.15.0")
}
because("CVE-2021-44228 Log4j 2 Vulnerability")
}
}
即，剛好log4j-core夠用，版本范圍必須正好[2.15,3[
uj5u.com熱心網友回復：
這個庫依賴于org.slf4j:slf4j-api:1.7.25.
dependencies {
testIplementation 'org.apache.logging.log4j:log4j-slf4j-impl:2.15.0'
}
可能不需要任何constraints; 試試mavenCentral()？正如人們所見（上面的鏈接），它帶有編譯、運行時和測驗依賴項。當 Maven Central 建議這應該是時testImplementation，這可能是要使用的正確配置。
uj5u.com熱心網友回復：
Gradle 團隊發布了專門針對 2.15.0 之前版本中的關鍵 Log4J 錯誤的解決方法。但是，已經報告了一個新漏洞，該漏洞促使 2.16.0 的發布，因此您應該相應地更新您的規則。
但是，如果您使用 Spring 的依賴管理插件，Gradle 推薦的修復程式將不起作用id("io.spring.dependency-management") version "x.y.z"。
要在沒有 Spring 依賴管理的情況下處理 Gradle 依賴，只需創建一個插件來設定 Log4J 的版本要求：
object Log4jConvention : ServiceConvention {
private val log = KotlinLogging.logger { }
private val dependencies = listOf(
"org.apache.logging.log4j:log4j-core",
"org.apache.logging.log4j:log4j-slf4j-impl",
"org.apache.logging.log4j:log4j-jul"
)
override fun apply(project: Project) {
project.dependencies.constraints { constraints ->
listOf("compileClasspath", "implementation", "runtimeOnly", "runtimeClasspath").forEach { configuration ->
dependencies.forEach { dependency ->
constraints.add(configuration, dependency) { c ->
c.version { v ->
v.strictly("[2.16, 3[")
v.require("2.16.0")
v.reject("[2.0, 2.16[")
}
c.because("CVE-2021-44228: Log4j vulnerable to remote code execution")
log.info { "Applied log4j version constraint to $dependency for configuration $configuration" }
}
}
}
}
log.info { "Applied log4j version constraints" }
}
}
處理 Spring Boot 依賴管理：
object SpringBootLog4jConvention : ServiceConvention {
private val log = KotlinLogging.logger { }
override fun apply(project: Project) {
project.plugins.findPlugin("io.spring.dependency-management") ?: return
project.configurations.all {
it.resolutionStrategy.eachDependency { details ->
if (details.requested.group == "org.apache.logging.log4j") {
details.useVersion("2.16. ")
}
}
}
log.info { "Applied fixed Log4J resolution to Spring dependency management" }
}
}
轉載請註明出處，本文鏈接：https://www.uj5u.com/yidong/382355.html