JDBCAppender.java
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.apache.log4j.jdbc;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.ArrayList;
import org.apache.log4j.PatternLayout;
import org.apache.log4j.helpers.LogLog;
import org.apache.log4j.spi.ErrorCode;
import org.apache.log4j.spi.LoggingEvent;
/**
* The JDBCAppender provides for sending log events to a database. It does not log exceptions.
*
* <p><b>JDBCAppender shipping in 1.2.18.2 produces
* {@link java.sql.PreparedStatement PreparedStatement} instances</b>. Thanks to the remarkable work of Vladimir
* Sitnikov JDBCAppender now interprets the SQL expression on the fly and inserts new events using PreparedStartement
* instances. Note that the table column types are restricted to those types compatible with Java's String.
* </p>
*
* <p><font color="#FF2222" style="font-weight: bold;">Versions 1.2.18.0 and prior
* are vulnerable to SQL injection attacks.</b></font>.
* </p>
*
* <p>
* Each append call adds to an {@link ArrayList} buffer. When the buffer is filled each log event is placed in a sql
* statement (configurable) and executed.
* </p>
*
* <p><b>BufferSize</b>, <b>db URL</b>, <b>User</b>, & <b>Password</b> are
* configurable options in the standard log4j fashion.
* </p>
*
* <p>
* The <code>setSql(String sql)</code> sets the SQL statement to be used for logging -- this statement is sent to a
* <code>PatternLayout</code> (either created automatically by the appender or added by the user). Therefore by default
* all the conversion patterns in <code>PatternLayout</code> can be used inside of the statement. (see the test cases
* for examples).
* </p>
* <p>As mentioned earlier, the produced
* SQL is translated in an additional phase to use {@link java.sql.PreparedStatement PreparedStatement}.
* </p>
*
*
* <p>
* For use as a base class:
*
* <ul>
*
* <li>Override <code>getConnection()</code> to pass any connection you want.
* Typically this is used to enable application wide connection pooling.
*
* <li>Override <code>closeConnection(Connection con)</code> -- if you override
* getConnection make sure to implement <code>closeConnection</code> to handle
* the connection you generated. Typically this would return the connection to
* the pool it came from.
*
* <li>As of 1.2.18.1 {@link #getLogStatement} is no longer in use.
*
* </ul>
*
* @author Kevin Steppe (<A HREF="mailto:ksteppe@pacbell.net">ksteppe@pacbell.net</A>)
*/
public class JDBCAppender extends org.apache.log4j.AppenderSkeleton implements org.apache.log4j.Appender {
// private final Boolean secureSqlReplacement = Boolean
// .parseBoolean(System.getProperty("org.apache.log4j.jdbc.JDBCAppender.secure_jdbc_replacement", "true"));
private static final IllegalArgumentException ILLEGAL_PATTERN_FOR_SECURE_EXEC = new IllegalArgumentException(
"Only org.apache.log4j.PatternLayout is supported for now due to CVE-2022-23305");
/**
* URL of the DB for default connection handling
*/
protected String databaseURL = "jdbc:odbc:myDB";
/**
* User to connect as for default connection handling
*/
protected String databaseUser = "me";
/**
* User to use for default connection handling
*/
protected String databasePassword = "mypassword";
/**
* Connection used by default. The connection is opened the first time it is needed and then held open until the
* appender is closed (usually at garbage collection). This behavior is best modified by creating a sub-class and
* overriding the <code>getConnection</code> and <code>closeConnection</code> methods.
*/
protected Connection connection = null;
/**
* Stores the string given to the pattern layout for conversion into a SQL statement, eg: insert into LogTable
* (Thread, Class, Message) values ("%t", "%c", "%m").
* <p>
* Be careful of quotes in your messages!
* <p>
* Also see PatternLayout.
*/
protected String sqlStatement = "";
private JdbcPatternParser preparedStatementParser;
/**
* size of LoggingEvent buffer before writting to the database. Default is 1.
*/
protected int bufferSize = 1;
/**
* ArrayList holding the buffer of Logging Events.
*/
protected ArrayList<LoggingEvent> buffer;
private boolean locationInfo = false;
private boolean isActive = false;
public JDBCAppender() {
super();
buffer = new ArrayList<LoggingEvent>(bufferSize);
}
@Override
public void activateOptions() {
if (getSql() == null || getSql().trim().length() == 0) {
LogLog.error("JDBCAppender.sql parameter is mandatory. Skipping all futher processing");
isActive = false;
return;
}
LogLog.debug("JDBCAppender constructing internal pattern parser");
preparedStatementParser = new JdbcPatternParser(getSql());
isActive = true;
}
/**
* Gets whether the location of the logging request call should be captured.
*
* @return the current value of the <b>LocationInfo</b> option.
* @since 1.2.16
*/
public boolean getLocationInfo() {
return locationInfo;
}
/**
* The <b>LocationInfo</b> option takes a boolean value. By default, it is set to false which means there will be no
* effort to extract the location information related to the event. As a result, the event that will be ultimately
* logged will likely to contain the wrong location information (if present in the log format).
* <p/>
* <p/>
* Location information extraction is comparatively very slow and should be avoided unless performance is not a
* concern.
* </p>
*
* @param flag true if location information should be extracted.
* @since 1.2.16
*/
public void setLocationInfo(final boolean flag) {
locationInfo = flag;
}
/**
* Adds the event to the buffer. When full the buffer is flushed.
*/
public void append(LoggingEvent event) {
if (!isActive) {
return;
}
event.getNDC();
event.getThreadName();
// Get a copy of this thread's MDC.
event.getMDCCopy();
if (locationInfo) {
event.getLocationInformation();
}
event.getRenderedMessage();
event.getThrowableStrRep();
buffer.add(event);
if (buffer.size() >= bufferSize)
flushBuffer();
}
/**
* <p>
* <b>As of 1.2.18.1 {@link #getLogStatement} is no longer in use.</b>
* </p>
*
* @param event
*/
protected String getLogStatement(LoggingEvent event) {
return "";
}
/**
* Override this to provide an alertnate method of getting connections (such as caching). One method to fix this is
* to open connections at the start of flushBuffer() and close them at the end. I use a connection pool outside of
* JDBCAppender which is accessed in an override of this method.
*/
protected void execute(String sql) throws SQLException {
Connection con = null;
Statement stmt = null;
try {
con = getConnection();
stmt = con.createStatement();
stmt.executeUpdate(sql);
} finally {
if (stmt != null) {
stmt.close();
}
closeConnection(con);
}
// System.out.println("Execute: " + sql);
}
/**
* Override this to return the connection to a pool, or to clean up the resource.
* <p>
* The default behavior holds a single connection open until the appender is closed (typically when garbage
* collected).
*/
protected void closeConnection(Connection con) {
}
/**
* Override this to link with your connection pooling system.
* <p>
* By default this creates a single connection which is held open until the object is garbage collected.
*/
protected Connection getConnection() throws SQLException {
if (!DriverManager.getDrivers().hasMoreElements())
setDriver("sun.jdbc.odbc.JdbcOdbcDriver");
if (connection == null) {
connection = DriverManager.getConnection(databaseURL, databaseUser, databasePassword);
}
return connection;
}
/**
* Closes the appender, flushing the buffer first then closing the default connection if it is open.
*/
public void close() {
flushBuffer();
try {
if (connection != null && !connection.isClosed())
connection.close();
} catch (SQLException e) {
errorHandler.error("Error closing connection", e, ErrorCode.GENERIC_FAILURE);
}
this.closed = true;
}
/**
* loops through the buffer of LoggingEvents, gets a sql string from getLogStatement() and sends it to execute().
* Errors are sent to the errorHandler.
* <p>
* If a statement fails the LoggingEvent stays in the buffer!
*/
public void flushBuffer() {
if (buffer.isEmpty()) {
return;
}
flushBufferSecure();
}
private void flushBufferSecure() {
// Prepare events that we will store to the DB
ArrayList<LoggingEvent> removes = new ArrayList<LoggingEvent>(buffer);
buffer.removeAll(removes);
if (layout.getClass() != PatternLayout.class) {
errorHandler.error("Failed to convert pattern " + layout + " to SQL", ILLEGAL_PATTERN_FOR_SECURE_EXEC,
ErrorCode.MISSING_LAYOUT);
return;
}
Connection con = null;
boolean useBatch = removes.size() > 1;
try {
con = getConnection();
PreparedStatement ps = con.prepareStatement(preparedStatementParser.getParameterizedSql());
safelyInsertIntoDB(removes, useBatch, ps);
} catch (SQLException e) {
errorHandler.error("Failed to append messages sql", e, ErrorCode.FLUSH_FAILURE);
} finally {
if (con != null) {
closeConnection(con);
}
}
}
private void safelyInsertIntoDB(ArrayList<LoggingEvent> removes, boolean useBatch, PreparedStatement ps)
throws SQLException {
try {
for (LoggingEvent logEvent : removes) {
try {
preparedStatementParser.setParameters(ps, logEvent);
if (useBatch) {
ps.addBatch();
}
} catch (SQLException e) {
errorHandler.error("Failed to append parameters", e, ErrorCode.FLUSH_FAILURE);
}
}
if (useBatch) {
ps.executeBatch();
} else {
ps.execute();
}
} finally {
try {
ps.close();
} catch (SQLException ignored) {
}
}
}
/**
* closes the appender before disposal
*/
public void finalize() {
close();
}
/**
* JDBCAppender requires a layout.
*/
public boolean requiresLayout() {
return true;
}
/**
*
*/
public void setSql(String s) {
sqlStatement = s;
if (getLayout() == null) {
this.setLayout(new PatternLayout(s));
} else {
((PatternLayout) getLayout()).setConversionPattern(s);
}
}
/**
* Returns pre-formated statement eg: insert into LogTable (msg) values ("%m")
*/
public String getSql() {
return sqlStatement;
}
public void setUser(String user) {
databaseUser = user;
}
public void setURL(String url) {
databaseURL = url;
}
public void setPassword(String password) {
databasePassword = password;
}
public void setBufferSize(int newBufferSize) {
bufferSize = newBufferSize;
buffer.ensureCapacity(bufferSize);
}
public String getUser() {
return databaseUser;
}
public String getURL() {
return databaseURL;
}
public String getPassword() {
return databasePassword;
}
public int getBufferSize() {
return bufferSize;
}
/**
* Ensures that the given driver class has been loaded for sql connection creation.
*/
public void setDriver(String driverClass) {
try {
Class.forName(driverClass);
} catch (Exception e) {
errorHandler.error("Failed to load driver", e, ErrorCode.GENERIC_FAILURE);
}
}
}