From 2f91c8ed36cf63f14aae1ceb34a1c46f5a11afe1 Mon Sep 17 00:00:00 2001 From: Louis Jacomet Date: Tue, 14 Dec 2021 18:23:56 +0100 Subject: [PATCH] Rework buildscript classpath log4j fix This now uses a combination of require and reject instead of a strictly, which will allow updates beyond the 2.x line. The previous solution was effectively preventing that with no way for the user to change that. Issue #19300 --- .../initialization/DefaultScriptHandler.java | 4 +- ...iptDependencyResolveIntegrationTest.groovy | 48 ++++++++++++++++++- .../logging/util/Log4jBannedVersion.java | 3 +- .../api/plugins/scala/ScalaBasePlugin.java | 2 +- 4 files changed, 51 insertions(+), 6 deletions(-) diff --git a/subprojects/core/src/main/java/org/gradle/api/internal/initialization/DefaultScriptHandler.java b/subprojects/core/src/main/java/org/gradle/api/internal/initialization/DefaultScriptHandler.java index 9cb94f169399..01f8bc0c71ad 100644 --- a/subprojects/core/src/main/java/org/gradle/api/internal/initialization/DefaultScriptHandler.java +++ b/subprojects/core/src/main/java/org/gradle/api/internal/initialization/DefaultScriptHandler.java @@ -142,8 +142,8 @@ private void defineConfiguration() { attributes.attribute(GradlePluginApiVersion.GRADLE_PLUGIN_API_VERSION_ATTRIBUTE, instantiator.named(GradlePluginApiVersion.class, GradleVersion.current().getVersion())); classpathConfiguration.getDependencyConstraints().add(dependencyHandler.getConstraints().create(Log4jBannedVersion.LOG4J2_CORE_COORDINATES, constraint -> constraint.version(version -> { - version.strictly(Log4jBannedVersion.LOG4J2_CORE_STRICT_VERSION_RANGE); - version.prefer(Log4jBannedVersion.LOG4J2_CORE_PREFERRED_VERSION); + version.require(Log4jBannedVersion.LOG4J2_CORE_REQUIRED_VERSION); + version.reject(Log4jBannedVersion.LOG4J2_CORE_VULNERABLE_VERSION_RANGE); }))); } } diff --git a/subprojects/dependency-management/src/integTest/groovy/org/gradle/integtests/resolve/ScriptDependencyResolveIntegrationTest.groovy b/subprojects/dependency-management/src/integTest/groovy/org/gradle/integtests/resolve/ScriptDependencyResolveIntegrationTest.groovy index 56259604d1b2..c7235022ca7f 100644 --- a/subprojects/dependency-management/src/integTest/groovy/org/gradle/integtests/resolve/ScriptDependencyResolveIntegrationTest.groovy +++ b/subprojects/dependency-management/src/integTest/groovy/org/gradle/integtests/resolve/ScriptDependencyResolveIntegrationTest.groovy @@ -17,6 +17,7 @@ package org.gradle.integtests.resolve import org.gradle.integtests.fixtures.AbstractDependencyResolutionTest +import org.gradle.integtests.fixtures.ToBeFixedForConfigurationCache import org.gradle.test.fixtures.file.LeaksFileHandles import spock.lang.Issue @@ -90,9 +91,11 @@ rootProject.name = 'testproject' failureHasCause("Conflict(s) found for the following module(s):") } + @ToBeFixedForConfigurationCache(because = ":buildEnvironment") + @Issue("gradle/gradle#19300") def 'carries implicit constraint for log4j-core'() { given: - mavenRepo().module('org.apache.logging.log4j', 'log4j-core', '2.15.0').publish() + mavenRepo().module('org.apache.logging.log4j', 'log4j-core', '2.16.0').publish() and: settingsFile << """ @@ -116,6 +119,47 @@ rootProject.name = 'testproject' """ expect: - succeeds 'help' + succeeds 'buildEnvironment' + outputContains('org.apache.logging.log4j:log4j-core:{require 2.16.0; reject [2.0, 2.15[} -> 2.16.0 (c)') + } + + @Issue("gradle/gradle#19300") + def 'fails if build attempts to force vulnerable log4j-core'() { + given: + settingsFile << """ + rootProject.name = 'testproject' + """ + + buildFile << """ + buildscript { + repositories { maven { url "${mavenRepo().uri}" } } + dependencies { + classpath "org.apache.logging.log4j:log4j-core:2.14.1!!" + } + } + """ + + expect: + fails 'help' + failureCauseContains('Cannot find a version of \'org.apache.logging.log4j:log4j-core\' that satisfies the version constraints') + } + + @ToBeFixedForConfigurationCache(because = ":buildEnvironment") + @Issue("gradle/gradle#19300") + def 'allows to upgrade log4j to 3.x one day'() { + given: + mavenRepo().module('org.apache.logging.log4j', 'log4j-core', '3.1.0').publish() + buildFile << """ + buildscript { + repositories { maven { url "${mavenRepo().uri}" } } + dependencies { + classpath "org.apache.logging.log4j:log4j-core:3.1.0" + } + } + """ + + expect: + succeeds 'buildEnvironment' + outputContains('org.apache.logging.log4j:log4j-core:{require 2.16.0; reject [2.0, 2.15[} -> 3.1.0 (c)') } } diff --git a/subprojects/logging/src/main/java/org/gradle/internal/logging/util/Log4jBannedVersion.java b/subprojects/logging/src/main/java/org/gradle/internal/logging/util/Log4jBannedVersion.java index f919d27615f9..0ebb71f69a1f 100644 --- a/subprojects/logging/src/main/java/org/gradle/internal/logging/util/Log4jBannedVersion.java +++ b/subprojects/logging/src/main/java/org/gradle/internal/logging/util/Log4jBannedVersion.java @@ -23,5 +23,6 @@ public class Log4jBannedVersion { public static final String LOG4J2_CORE_COORDINATES = "org.apache.logging.log4j:log4j-core"; public static final String LOG4J2_CORE_STRICT_VERSION_RANGE = "[2.15, 3["; - public static final String LOG4J2_CORE_PREFERRED_VERSION = "2.15.0"; + public static final String LOG4J2_CORE_VULNERABLE_VERSION_RANGE = "[2.0, 2.15["; + public static final String LOG4J2_CORE_REQUIRED_VERSION = "2.16.0"; } diff --git a/subprojects/scala/src/main/java/org/gradle/api/plugins/scala/ScalaBasePlugin.java b/subprojects/scala/src/main/java/org/gradle/api/plugins/scala/ScalaBasePlugin.java index 1b38244f3ec5..a1ede2cc31b9 100644 --- a/subprojects/scala/src/main/java/org/gradle/api/plugins/scala/ScalaBasePlugin.java +++ b/subprojects/scala/src/main/java/org/gradle/api/plugins/scala/ScalaBasePlugin.java @@ -157,7 +157,7 @@ private void configureConfigurations(final Project project, final Usage incremen zinc.getDependencyConstraints().add(dependencyHandler.getConstraints().create(Log4jBannedVersion.LOG4J2_CORE_COORDINATES, constraint -> constraint.version(version -> { version.strictly(Log4jBannedVersion.LOG4J2_CORE_STRICT_VERSION_RANGE); - version.prefer(Log4jBannedVersion.LOG4J2_CORE_PREFERRED_VERSION); + version.prefer(Log4jBannedVersion.LOG4J2_CORE_REQUIRED_VERSION); }))); final Configuration incrementalAnalysisElements = project.getConfigurations().create("incrementalScalaAnalysisElements");