log4shell hacking

Author: Eric Smalling

todolist-goof/todolist-web-struts/pom.xml

@@ -24,6 +24,17 @@
             <version>0.0.1-SNAPSHOT</version>
         </dependency>
 
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-core</artifactId>
+            <version>2.7</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-api</artifactId>
+            <version>2.7</version>
+        </dependency>
+
         <!-- javaee web api -->
         <dependency>
             <groupId>javax</groupId>

todolist-goof/todolist-web-struts/src/main/java/io/github/benas/todolist/web/action/todo/SearchTodoAction.java

@@ -30,18 +30,23 @@
 
 import java.util.List;
 
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
 /**
  * Action class to search todo list by title.
  *
  * @author Mahmoud Ben Hassine ([email protected])
  */
 public class SearchTodoAction extends BaseAction {
+    private static final Logger logger = LogManager.getLogger(SearchTodoAction.class);
 
     private String title;
 
     List<Todo> todoList;
 
     public String execute() {
+        logger.info("Searching for: " + title);
         todoList = todoService.searchTodoListByTitle(getSessionUser().getId(), title);
         return Action.SUCCESS;
     }

todolist-goof/todolist-web-struts/src/main/resources/log4j2.properties

@@ -0,0 +1,16 @@
+# Extra logging related to initialization of Log4j
+# Set to debug or trace if log4j initialization is failing
+status = warn
+# Name of the configuration
+name = ConsoleLogConfigDemo
+
+# Console appender configuration
+appender.console.type = Console
+appender.console.name = consoleLogger
+appender.console.layout.type = PatternLayout
+appender.console.layout.pattern = %d{yyyy-MM-dd HH:mm:ss} %-5p %c{1}:%L - %m%n
+
+# Root logger level
+rootLogger.level = info
+# Root logger referring to console appender
+rootLogger.appenderRef.stdout.ref = consoleLogger