Giter Club home page Giter Club logo

Comments (9)

mindstorm38 avatar mindstorm38 commented on May 31, 2024

https://www.lunasec.io/docs/blog/log4j-zero-day/

from portablemc.

mindstorm38 avatar mindstorm38 commented on May 31, 2024

Mojang has made the following changes to logging configurations:

<!-- client-1.7.xml -->
<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="WARN">
    <Appenders>
        <Console name="SysOut" target="SYSTEM_OUT">
            <XMLLayout />
        </Console>
        <RollingRandomAccessFile name="File" fileName="logs/latest.log" filePattern="logs/%d{yyyy-MM-dd}-%i.log.gz">
            <PatternLayout pattern="[%d{HH:mm:ss}] [%t/%level]: %msg%n" />
            <Policies>
                <TimeBasedTriggeringPolicy />
                <OnStartupTriggeringPolicy />
            </Policies>
        </RollingRandomAccessFile>
    </Appenders>
    <Loggers>
        <Root level="info">
            <filters>
                <MarkerFilter marker="NETWORK_PACKETS" onMatch="DENY" onMismatch="NEUTRAL" />
                <!-- ADDED BEGIN -->
                <RegexFilter regex=".*\$\{[^}]*\}.*" onMatch="DENY" onMismatch="NEUTRAL"/>
                <!-- ADDED END -->
            </filters>
            <AppenderRef ref="SysOut"/>
            <AppenderRef ref="File"/>
        </Root>
    </Loggers>
</Configuration>
<!-- client-1.12.xml -->
<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="WARN">
    <Appenders>
        <Console name="SysOut" target="SYSTEM_OUT">
            <LegacyXMLLayout />
        </Console>
        <RollingRandomAccessFile name="File" fileName="logs/latest.log" filePattern="logs/%d{yyyy-MM-dd}-%i.log.gz">
            <!-- BEFORE: <PatternLayout pattern="[%d{HH:mm:ss}] [%t/%level]: %msg%n" /> -->
            <PatternLayout pattern="[%d{HH:mm:ss}] [%t/%level]: %msg{nolookups}%n" />
            <Policies>
                <TimeBasedTriggeringPolicy />
                <OnStartupTriggeringPolicy />
            </Policies>
        </RollingRandomAccessFile>
    </Appenders>
    <Loggers>
        <Root level="info">
            <filters>
                <MarkerFilter marker="NETWORK_PACKETS" onMatch="DENY" onMismatch="NEUTRAL" />
            </filters>
            <AppenderRef ref="SysOut"/>
            <AppenderRef ref="File"/>
        </Root>
    </Loggers>
</Configuration>

from portablemc.

mindstorm38 avatar mindstorm38 commented on May 31, 2024

After checking, PMC special log configuration is not update, CLI is critically affected by this exploit, API is not.

from portablemc.

mindstorm38 avatar mindstorm38 commented on May 31, 2024

It's quite hard to fix, because the launcher currently ignore update of the "time" from the version manifest.

from portablemc.

mindstorm38 avatar mindstorm38 commented on May 31, 2024

I'm a little embarrassed, it takes more work than I expected, as I had never considered the case of a critical change in the existing version metadata. This might introduce an argument --timeout to control the timeout to request versions manifest, I will also properly handle HTTP cache system only for it.

from portablemc.

intact avatar intact commented on May 31, 2024

Maybe download that data whenever something needs it and you can add someting like --offline later.

from portablemc.

mindstorm38 avatar mindstorm38 commented on May 31, 2024

I thought of this --offline argument, but it can just be the equivalent of --timeout 0 which is an illegal value for a timeout, and so can be used to disable online manifest fetching (only using the local copy, and aborting if there is no local copy).

from portablemc.

mindstorm38 avatar mindstorm38 commented on May 31, 2024

Almost ready to release! The last thing to implement is the timeout argument.

This is more an improvement to the API than a particular fix for the exploit, the launcher is now able to install newer official metadata when needed. If Mojang implement another fixes in the future, they should be downloaded automatically.

from portablemc.

mindstorm38 avatar mindstorm38 commented on May 31, 2024

This issue is important, but it is referenced in the README, so I'm closing it.

from portablemc.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.