natas_hw
/
slf4j
mirror of https://github.com/qos-ch/slf4j
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix comments, less bragging 

Signed-off-by: Ceki Gulcu <ceki@qos.ch>
This commit is contained in:
Ceki Gulcu 2022-01-24 00:07:40 +01:00
parent c69570fc51
commit f04cf16b66
2 changed files with 2 additions and 107 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
slf4j-site/src/site/pages/css/site.css
View File

@ -50,7 +50,7 @@ p.menu {
"left content right";
max-width: 90rem;
margin-left: 1rem;
# margin-right: auto;
/** margin-right: auto; **/
}
@ -83,7 +83,7 @@ p.menu {
margin: 4px 4px 0px 0px;
padding: 0px;
background-color: #ffffff;
#border: 1px solid #cccccc;
/** #border: 1px solid #cccccc; **/
font-size: 80%;
}

105
slf4j-site/src/site/pages/log4shell.html
View File

@ -235,111 +235,6 @@
<code>owner</code>. If possible, they should also be monitored
against changes and unauthorized manipulation.</p>
<h3 class="doAnchor" name="prevalence">Prevalence of logging
frameworks</h3>
<p>As discussed above, while log4j 2.14 and earlier are
vulnerable to log4shell, log4j 1.x and logback are not.</p>
<p>At this stage, it might be useful mention the prevalence of
each logging library in order to put things into
perspective. Here are the relevant figures as found
in <a href="https://mvnrepository.com/">mvnrepository site</a>
on 2021-12-17. </p>
<table class="bodyTable striped" cellspacing="4" cellpadding="4">
<tr>
<th>Project</th>
<th>Category</th>
<th>group:artifact</th>
<th>usageCount</th>
<th>percentage</th>
</tr>
<tr>
<td>SLF4J</td>
<td>API</td>
<td>org.slf4j:slf4j-api</td>
<td>52,247</td>
<td>69%</td>
</tr>
<tr>
<td>Commons-logging</td>
<td>API</td>
<td>commons-logging:commons-logging</td>
<td>10,412</td>
<td>14%</td>
</tr>
<tr>
<td>SLF4J</td>
<td>API</td>
<td>org.slf4j:jcl-over-slf4j</td>
<td>7,546</td>
<td>10%</td>
</tr>
<tr>
<td>LOG4J2</td>
<td>API</td>
<td>org.apache.logging.log4j:log4j-api</td>
<td>5,226</td>
<td> 7%</td>
</tr>
<tr>
<td>Total</td>
<td>API </td>
<td>-</td>
<td>75,431 </td>
<td>100%</td>
</tr>
</table>
<table class="bodyTable striped" cellspacing="4" cellpadding="4">
<tr>
<th>Project</th>
<th>Category</th>
<th>group:artifact</th>
<th>usageCount</th>
<th>percentage</th>
</tr>
<tr>
<td>LOGBACK</td>
<td>implementation</td>
<td>ch.qos.logback:logback-classic</td>
<td>21,770</td>
<td>48%</td>
</tr>
<tr>
<td>LOG4J1</td>
<td>implementation</td>
<td>log4j:log4j</td>
<td>16,610</td>
<td>37%</td>
</tr>
<tr>
<td>LOG4J2</td>
<td>implementation</td>
<td>org.apache.logging.log4j:log4j-core</td>
<td>6,974</td>
<td>15%</td>
</tr>
<tr>
<td>Total</td>
<td>implementaion </td>
<td>-</td>
<td>45,174 </td>
<td>100%</td>
</tr>
</table>
<p>Notwithstanding its 48% prevalence overall (implementation),
no attacks have been reported against logback that we are aware
of.</p>
<h3>Further reading</h3>