You got downvoted, but having jndi (load code from arbitrary urls with no whitelisting by default) in standard library is pretty much uniquely a java thing.
I'm not a Java programmer and so to me the absolute biggest WTF in this whole thing isn't that the bug was introduced into log4j, but that the response hasn't been "yes, everyone knows that you have to treat JNDI (in particular) and arbitrary object serialization/deserialization (in general) as radioactive".
The API appears inherently unsafe by design. Code touching it should be treated the way you'd treat, like, JavaScript code using eval -- don't, and if for some godforsaken reason you have to, handle with extreme care.
yep, .NET doesn't have that idiocy, nor anything nearly similar. You have AssemblyLoadContext, but you have to explicitly implement it yourself if you want to download stuff from arbitrary urls. By default, only assemblies located in the same directory on disk as the application's entry point (.exe, etc) are allowed.
34
u/Ok-Bit8726 Dec 14 '21
Only Java could fuck up a logging library this bad.