apache / apache/logging-log4j2

Merge `ColumnConfig` and `ColumnMapping` and harden them

Open
#1,915 7 comments 0 reactions 0 assignees View on GitHub
appenders appenders:JDBC
Dominant language
Java
Stars
3.6k
Forks
1.7k
Avg merge
21h 30m
Merged PRs (30d)
27

Description

The JDBC appender right now provides two ways to configure the column mapping: `ColumnMapping` (used also by other appenders) and the JDBC specific `ColumnConfig`. Neither of them is deprecated or recommended.

I would propose to:

- merge the functionality of these two configuration knobs,
- add a kill-switch that prevents users from unintentionally injecting SQL using these column mappings. A setting like `literal="A great string"` inserts `A great string` into the SQL statement **without** quoting it. This behavior **is** documented, but it would be probably safer to **quote** everything unless the user provides an additional property (e.g. `quoteLiteral="false"`). This would make the configuration more foolproof.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.