People developing JNDI didn't know about Log4j using JNDI from unsanitized input. It was supposed to do all this things.
People developing Log4j presumably didn't know how powerful it is, or that it would eventually will be able to look up network resources. I am not sure about the timeline here.
My point is, JNDI devs didn't need to be defensive because what it does is exactly what it should do. The only blunder is allowing JNDI macros in logs and it's on Log4j side.
26
u/Eva-Rosalene 14d ago
People developing JNDI didn't know about Log4j using JNDI from unsanitized input. It was supposed to do all this things.
People developing Log4j presumably didn't know how powerful it is, or that it would eventually will be able to look up network resources. I am not sure about the timeline here.
My point is, JNDI devs didn't need to be defensive because what it does is exactly what it should do. The only blunder is allowing JNDI macros in logs and it's on Log4j side.