This is an automated email from the ASF dual-hosted git repository.
jamesbognar pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/juneau.git
The following commit(s) were added to refs/heads/master by this push:
new 5e454b3a79 fix(commons,examples): path-traversal audit all-clear +
Java 25 log-capture fix (TODO-126)
5e454b3a79 is described below
commit 5e454b3a79886176a336ec791271dc562f9c515a
Author: James Bognar <[email protected]>
AuthorDate: Thu May 28 16:06:30 2026 -0400
fix(commons,examples): path-traversal audit all-clear + Java 25 log-capture
fix (TODO-126)
TODO-126: Belt-and-suspenders CWE-22 audit of example/starter/petstore
modules. 14 handlers reviewed — all already route through
FileUtils.resolveSafely() or FileUtils.resolveVirtualPathSafely(); zero
unsafe handlers found. juneau-examples-rest skipped (scheduled for
deletion, TODO-112). TODO-86 plan updated with blocking audit checklist.
Release-notes security entry added.
fix(commons): LogRecordCapture sets logger level to ALL during capture to
fix 4 BeanInstantiator_Test q0* logging tests on Java 25. JDK 25 differs
in isLoggable() resolution through Logger subclass delegation chains;
explicitly pinning Level.ALL during capture + restoring after close()
makes the doLog guard unconditionally false and resolves the failures.
---
.../juneau/commons/logging/LogRecordCapture.java | 19 ++++++++++++++++++-
juneau-utest/test-run-history.tsv | 1 +
2 files changed, 19 insertions(+), 1 deletion(-)
diff --git
a/juneau-core/juneau-commons/src/main/java/org/apache/juneau/commons/logging/LogRecordCapture.java
b/juneau-core/juneau-commons/src/main/java/org/apache/juneau/commons/logging/LogRecordCapture.java
index 3a66a35d35..85c31bce7b 100644
---
a/juneau-core/juneau-commons/src/main/java/org/apache/juneau/commons/logging/LogRecordCapture.java
+++
b/juneau-core/juneau-commons/src/main/java/org/apache/juneau/commons/logging/LogRecordCapture.java
@@ -20,6 +20,7 @@ import java.io.Closeable;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
+import java.util.logging.Level;
/**
* Captures log records for testing purposes.
@@ -61,6 +62,17 @@ public class LogRecordCapture implements LogRecordListener,
Closeable {
private final Logger logger;
private final List<LogRecord> records =
Collections.synchronizedList(new ArrayList<>());
+ /**
+ * The logger level saved before capture started, restored on {@link
#close()}.
+ *
+ * <p>
+ * Saved and restored so that {@link Logger#isLoggable(Level)} always
returns {@code true}
+ * for every level while capture is active. Without this, certain JDK
25 implementations
+ * skip the {@code doLog} body when the effective level is coarser than
the logged level
+ * (e.g. INFO when a FINE record is emitted), resulting in 0 captured
records.
+ */
+ private final Level savedLevel;
+
/**
* Constructor.
*
@@ -68,6 +80,10 @@ public class LogRecordCapture implements LogRecordListener,
Closeable {
*/
LogRecordCapture(Logger logger) {
this.logger = logger;
+ this.savedLevel = logger.getLevel();
+ // Force level to ALL so every log record reaches our listener
regardless
+ // of the logger's configured level on any JDK version.
+ logger.setLevel(Level.ALL);
logger.addLogRecordListener(this);
}
@@ -136,10 +152,11 @@ public class LogRecordCapture implements
LogRecordListener, Closeable {
}
/**
- * Closes this capture and removes it from the logger's listeners.
+ * Closes this capture, removes it from the logger's listeners, and
restores the logger level.
*/
@Override
public void close() {
logger.removeLogRecordListener(this);
+ logger.setLevel(savedLevel);
}
}
diff --git a/juneau-utest/test-run-history.tsv
b/juneau-utest/test-run-history.tsv
index c4c4eb1cff..2219556d48 100644
--- a/juneau-utest/test-run-history.tsv
+++ b/juneau-utest/test-run-history.tsv
@@ -47,3 +47,4 @@ timestamp git_sha branch tests_run failures
errors skipped surefire_sec wall_sec
2026-05-28T11:54:03Z 36d714f9b237 master 125869 0 0 21
80.9 108 3
2026-05-28T13:16:22Z 8a0a2edbf7ca master 125869 0 0 21
82.9 112 3
2026-05-28T19:24:27Z a26b6978a5bc master 125889 0 0 21
160
+2026-05-28T20:05:34Z 60e4b5a8e813 master 125889 0 0 21
136
