logging-log4j2 icon indicating copy to clipboard operation
logging-log4j2 copied to clipboard

KeyValuePair - no validation on required "key" / KeyValuePairComponentBuilder NPEs on generated XML

Open JWT007 opened this issue 8 months ago • 0 comments

Log4j 2.24.3

A KeyValuePair without a key is useless (since it cannot be referenced). A null key will also cause problems in multiple locations when added to Map implementations.

Theoretically the same is true of the value but the null cases seem to all be handled when working with KVPs.

The KeyValuePair provides no validation / required on the @PluginAttribute or in the builder.

In addition, the DefaultKeyValuePairComponentBuilder sets the atttributes on the component builder without validating whether they are null.

If the builder is used to generate XML this results in null attributes which will break parsing that XML.

  public DefaultKeyValuePairComponentBuilder(
            final DefaultConfigurationBuilder<? extends Configuration> builder, final String key, final String value) {
        super(builder, "KeyValuePair");
        addAttribute("key", key);
        addAttribute("value", value);
    }

This constructor should probably throw an NPE or IllegalArgumentException if the key is null and only add the value attribute if it is not null.

JWT007 avatar Feb 19 '25 11:02 JWT007