From f6d47034a4ce292e1a659fa00963f6f713117064 Mon Sep 17 00:00:00 2001
From: Sehrope Sarkuni <sehrope@jackdb.com>
Date: Tue, 15 Feb 2022 09:51:56 -0500
Subject: [PATCH] Merge pull request from GHSA-673j-qm5f-xpv8

Removes loggerFile and loggerLevel properties and defers to java.util.logging to
configure all logging in the driver. Users that previously specifyied custom
logging via those connection properties should change their applications to
instead configure via a java.util.logging properties file or system properties.

The properties and enum values are now deprecated and may be removed in a future
driver version.

Co-authored-by: Dave Cramer <davecramer@gmail.com>
---
 README.md                                     |  7 +-
 docs/documentation/head/connect.md            | 12 +--
 .../src/main/java/org/postgresql/Driver.java  | 74 +-----------------
 .../main/java/org/postgresql/PGProperty.java  | 22 +-----
 .../postgresql/ds/common/BaseDataSource.java  | 20 +++--
 .../org/postgresql/test/jdbc2/DriverTest.java | 67 ----------------
 .../postgresql/test/jdbc2/PGPropertyTest.java | 10 ---
 .../postgresql/test/jdbc4/Jdbc4TestSuite.java |  1 -
 .../org/postgresql/test/jdbc4/LogTest.java    | 78 -------------------
 9 files changed, 28 insertions(+), 263 deletions(-)
 delete mode 100644 pgjdbc/src/test/java/org/postgresql/test/jdbc4/LogTest.java

Index: src/postgresql-jdbc-42.2-10.src/README.md
===================================================================
--- src.orig/postgresql-jdbc-42.2-10.src/README.md
+++ src/postgresql-jdbc-42.2-10.src/README.md
@@ -103,6 +103,11 @@ where:
  * **database** (Optional) is the database name. Defaults to the same name as the *user name* used in the connection.
  * **propertyX** (Optional) is one or more option connection properties. For more information see *Connection properties*.
 
+### Logging
+PgJDBC uses java.util.logging for logging.
+To configure log levels and control log output destination (e.g. file or console), configure your java.util.logging properties accordingly for the org.postgresql logger.
+Note that the most detailed log levels, "`FINEST`", may include sensitive information such as connection details, query SQL, or command parameters.
+
 #### Connection Properties
 In addition to the standard connection parameters the driver supports a number of additional properties which can be used to specify additional driver behaviour specific to PostgreSQL™. These properties may be specified in either the connection URL or an additional Properties object parameter to DriverManager.getConnection.
 
@@ -123,8 +128,6 @@ In addition to the standard connection p
 | sslpassword                   | String  | null    | The password for the client's ssl key (ignored if sslpasswordcallback is set) |
 | sendBufferSize                | Integer | -1      | Socket write buffer size |
 | receiveBufferSize             | Integer | -1      | Socket read buffer size  |
-| loggerLevel                   | String  | null    | Logger level of the driver using java.util.logging. Allowed values: OFF, DEBUG or TRACE. |
-| loggerFile                    | String  | null    | File name output of the Logger, if set, the Logger will use a FileHandler to write to a specified file. If the parameter is not set or the file can't be created the ConsoleHandler will be used instead. |
 | allowEncodingChanges          | Boolean | false   | Allow for changes in client_encoding |
 | logUnclosedConnections        | Boolean | false   | When connections that are not explicitly closed are garbage collected, log the stacktrace from the opening of the connection to trace the leak source |
 | binaryTransferEnable          | String  | ""      | Comma separated list of types to enable binary transfer. Either OID numbers or names |
Index: src/postgresql-jdbc-42.2-10.src/docs/documentation/head/connect.md
===================================================================
--- src.orig/postgresql-jdbc-42.2-10.src/docs/documentation/head/connect.md
+++ src/postgresql-jdbc-42.2-10.src/docs/documentation/head/connect.md
@@ -165,17 +165,13 @@ Connection conn = DriverManager.getConne
  
 * **loggerLevel** = String
 
-	Logger level of the driver. Allowed values: <code>OFF</code>, <code>DEBUG</code> or <code>TRACE</code>.
-	This enable the <code>java.util.logging.Logger</code> Level of the driver based on the following mapping
-	of levels: DEBUG -&gt; FINE, TRACE -&gt; FINEST. This property is intended for debug the driver and
-	not for general SQL query debug.
+	This property is no longer used by the driver and will be ignored.
+	All logging configuration is handled by java.util.logging.
 
 * **loggerFile** = String
 
-	File name output of the Logger. If set, the Logger will use a <code>java.util.logging.FileHandler</code>
-	to write to a specified file. If the parameter is not set or the file can’t be created the
-	<code>java.util.logging.ConsoleHandler</code> will be used instead. This parameter should be use
-	together with loggerLevel.
+	This property is no longer used by the driver and will be ignored.
+	All logging configuration is handled by java.util.logging.
  
 * **allowEncodingChanges** = boolean
 
Index: src/postgresql-jdbc-42.2-10.src/pgjdbc/src/main/java/org/postgresql/Driver.java
===================================================================
--- src.orig/postgresql-jdbc-42.2-10.src/pgjdbc/src/main/java/org/postgresql/Driver.java
+++ src/postgresql-jdbc-42.2-10.src/pgjdbc/src/main/java/org/postgresql/Driver.java
@@ -7,14 +7,12 @@ package org.postgresql;
 
 import org.postgresql.jdbc.PgConnection;
 import org.postgresql.util.DriverInfo;
-import org.postgresql.util.ExpressionProperties;
 import org.postgresql.util.GT;
 import org.postgresql.util.HostSpec;
 import org.postgresql.util.PSQLException;
 import org.postgresql.util.PSQLState;
 import org.postgresql.util.SharedTimer;
 import org.postgresql.util.URLCoder;
-import org.postgresql.util.WriterHandler;
 
 import java.io.IOException;
 import java.io.InputStream;
@@ -32,11 +30,8 @@ import java.util.Enumeration;
 import java.util.Properties;
 import java.util.Set;
 import java.util.concurrent.TimeUnit;
-import java.util.logging.Formatter;
 import java.util.logging.Level;
 import java.util.logging.Logger;
-import java.util.logging.SimpleFormatter;
-import java.util.logging.StreamHandler;
 
 /**
  * <p>The Java SQL framework allows for multiple database drivers. Each driver should supply a class
@@ -243,8 +238,6 @@ public class Driver implements java.sql.
       return null;
     }
     try {
-      // Setup java.util.logging.Logger using connection properties.
-      setupLoggerFromProperties(props);
 
       LOGGER.log(Level.FINE, "Connecting with URL: {0}", url);
 
@@ -293,62 +286,12 @@ public class Driver implements java.sql.
    *
    * <p>See {@link PGProperty#LOGGER_FILE} and {@link PGProperty#LOGGER_FILE}</p>
    *
+   * this is an empty method left here for graalvm
+   * we removed the ability to setup the logger from properties
+   * due to a security issue
    * @param props Connection Properties
    */
   private void setupLoggerFromProperties(final Properties props) {
-    final String driverLogLevel = PGProperty.LOGGER_LEVEL.get(props);
-    if (driverLogLevel == null) {
-      return; // Don't mess with Logger if not set
-    }
-    if ("OFF".equalsIgnoreCase(driverLogLevel)) {
-      PARENT_LOGGER.setLevel(Level.OFF);
-      return; // Don't mess with Logger if set to OFF
-    } else if ("DEBUG".equalsIgnoreCase(driverLogLevel)) {
-      PARENT_LOGGER.setLevel(Level.FINE);
-    } else if ("TRACE".equalsIgnoreCase(driverLogLevel)) {
-      PARENT_LOGGER.setLevel(Level.FINEST);
-    }
-
-    ExpressionProperties exprProps = new ExpressionProperties(props, System.getProperties());
-    final String driverLogFile = PGProperty.LOGGER_FILE.get(exprProps);
-    if (driverLogFile != null && driverLogFile.equals(loggerHandlerFile)) {
-      return; // Same file output, do nothing.
-    }
-
-    for (java.util.logging.Handler handlers : PARENT_LOGGER.getHandlers()) {
-      // Remove previously set Handlers
-      handlers.close();
-      PARENT_LOGGER.removeHandler(handlers);
-      loggerHandlerFile = null;
-    }
-
-    java.util.logging.Handler handler = null;
-    if (driverLogFile != null) {
-      try {
-        handler = new java.util.logging.FileHandler(driverLogFile);
-        loggerHandlerFile = driverLogFile;
-      } catch (Exception ex) {
-        System.err.println("Cannot enable FileHandler, fallback to ConsoleHandler.");
-      }
-    }
-
-    Formatter formatter = new SimpleFormatter();
-
-    if ( handler == null ) {
-      if (DriverManager.getLogWriter() != null) {
-        handler = new WriterHandler(DriverManager.getLogWriter());
-      } else if ( DriverManager.getLogStream() != null) {
-        handler = new StreamHandler(DriverManager.getLogStream(), formatter);
-      } else {
-        handler = new StreamHandler(System.err, formatter);
-      }
-    } else {
-      handler.setFormatter(formatter);
-    }
-
-    handler.setLevel(PARENT_LOGGER.getLevel());
-    PARENT_LOGGER.setUseParentHandlers(false);
-    PARENT_LOGGER.addHandler(handler);
   }
 
   /**
Index: src/postgresql-jdbc-42.2-10.src/pgjdbc/src/main/java/org/postgresql/PGProperty.java
===================================================================
--- src.orig/postgresql-jdbc-42.2-10.src/pgjdbc/src/main/java/org/postgresql/PGProperty.java
+++ src/postgresql-jdbc-42.2-10.src/pgjdbc/src/main/java/org/postgresql/PGProperty.java
@@ -243,11 +243,8 @@ public enum PGProperty {
     "If disabled hosts are connected in the given order. If enabled hosts are chosen randomly from the set of suitable candidates"),
 
   /**
-   * <p>File name output of the Logger, if set, the Logger will use a
-   * {@link java.util.logging.FileHandler} to write to a specified file. If the parameter is not set
-   * or the file can't be created the {@link java.util.logging.ConsoleHandler} will be used instead.</p>
-   *
-   * <p>Parameter should be use together with {@link PGProperty#LOGGER_LEVEL}</p>
+   * This property is no longer used by the driver and will be ignored.
+   * Logging is configured via java.util.logging.
    */
   LOGGER_FILE(
     "loggerFile",
@@ -255,19 +252,8 @@ public enum PGProperty {
     "File name output of the Logger"),
 
   /**
-   * <p>Logger level of the driver. Allowed values: {@code OFF}, {@code DEBUG} or {@code TRACE}.</p>
-   *
-   * <p>This enable the {@link java.util.logging.Logger} of the driver based on the following mapping
-   * of levels:</p>
-   * <ul>
-   *     <li>FINE -&gt; DEBUG</li>
-   *     <li>FINEST -&gt; TRACE</li>
-   * </ul>
-   *
-   * <p><b>NOTE:</b> The recommended approach to enable java.util.logging is using a
-   * {@code logging.properties} configuration file with the property
-   * {@code -Djava.util.logging.config.file=myfile} or if your are using an application server
-   * you should use the appropriate logging subsystem.</p>
+   * This property is no longer used by the driver and will be ignored.
+   * Logging is configured via java.util.logging.
    */
   LOGGER_LEVEL(
     "loggerLevel",
Index: src/postgresql-jdbc-42.2-10.src/pgjdbc/src/main/java/org/postgresql/ds/common/BaseDataSource.java
===================================================================
--- src.orig/postgresql-jdbc-42.2-10.src/pgjdbc/src/main/java/org/postgresql/ds/common/BaseDataSource.java
+++ src/postgresql-jdbc-42.2-10.src/pgjdbc/src/main/java/org/postgresql/ds/common/BaseDataSource.java
@@ -1153,34 +1153,38 @@ public abstract class BaseDataSource imp
   }
 
   /**
-   * @return Logger Level of the JDBC Driver
-   * @see PGProperty#LOGGER_LEVEL
+   * This property is no longer used by the driver and will be ignored.
+   * @deprecated Configure via java.util.logging
    */
+  @Deprecated
   public String getLoggerLevel() {
     return PGProperty.LOGGER_LEVEL.get(properties);
   }
 
   /**
-   * @param loggerLevel of the JDBC Driver
-   * @see PGProperty#LOGGER_LEVEL
+   * This property is no longer used by the driver and will be ignored.
+   * @deprecated Configure via java.util.logging
    */
+  @Deprecated
   public void setLoggerLevel(String loggerLevel) {
     PGProperty.LOGGER_LEVEL.set(properties, loggerLevel);
   }
 
   /**
-   * @return File output of the Logger.
-   * @see PGProperty#LOGGER_FILE
+   * This property is no longer used by the driver and will be ignored.
+   * @deprecated Configure via java.util.logging
    */
+  @Deprecated
   public String getLoggerFile() {
     ExpressionProperties exprProps = new ExpressionProperties(properties, System.getProperties());
     return PGProperty.LOGGER_FILE.get(exprProps);
   }
 
   /**
-   * @param loggerFile File output of the Logger.
-   * @see PGProperty#LOGGER_LEVEL
+   * This property is no longer used by the driver and will be ignored.
+   * @deprecated Configure via java.util.logging
    */
+  @Deprecated
   public void setLoggerFile(String loggerFile) {
     PGProperty.LOGGER_FILE.set(properties, loggerFile);
   }
Index: src/postgresql-jdbc-42.2-10.src/pgjdbc/src/test/java/org/postgresql/test/jdbc2/DriverTest.java
===================================================================
--- src.orig/postgresql-jdbc-42.2-10.src/pgjdbc/src/test/java/org/postgresql/test/jdbc2/DriverTest.java
+++ src/postgresql-jdbc-42.2-10.src/pgjdbc/src/test/java/org/postgresql/test/jdbc2/DriverTest.java
@@ -15,13 +15,10 @@ import static org.junit.Assert.fail;
 import org.postgresql.Driver;
 import org.postgresql.PGProperty;
 import org.postgresql.test.TestUtil;
-import org.postgresql.util.NullOutputStream;
 import org.postgresql.util.URLCoder;
-import org.postgresql.util.WriterHandler;
 
 import org.junit.Test;
 
-import java.io.PrintWriter;
 import java.lang.reflect.Method;
 import java.sql.Connection;
 import java.sql.DriverManager;
@@ -29,8 +26,6 @@ import java.sql.SQLException;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.Properties;
-import java.util.logging.Handler;
-import java.util.logging.Logger;
 
 /*
  * Tests the dynamically created class org.postgresql.Driver
@@ -213,64 +208,4 @@ public class DriverTest {
     fail("Driver has not been found in DriverManager's list but it should be registered");
   }
 
-  @Test
-  public void testSetLogWriter() throws Exception {
-
-    // this is a dummy to make sure TestUtil is initialized
-    Connection con = DriverManager.getConnection(TestUtil.getURL(), TestUtil.getUser(), TestUtil.getPassword());
-    con.close();
-    String loggerLevel = System.getProperty("loggerLevel");
-    String loggerFile = System.getProperty("loggerFile");
-
-    try {
-      PrintWriter printWriter = new PrintWriter(new NullOutputStream(System.err));
-      DriverManager.setLogWriter(printWriter);
-      assertEquals(DriverManager.getLogWriter(), printWriter);
-      System.clearProperty("loggerFile");
-      System.clearProperty("loggerLevel");
-      Properties props = new Properties();
-      props.setProperty("user", TestUtil.getUser());
-      props.setProperty("password", TestUtil.getPassword());
-      props.setProperty("loggerLevel", "DEBUG");
-      con = DriverManager.getConnection(TestUtil.getURL(), props);
-
-      Logger logger = Logger.getLogger("org.postgresql");
-      Handler[] handlers = logger.getHandlers();
-      assertTrue(handlers[0] instanceof WriterHandler );
-      con.close();
-    } finally {
-      DriverManager.setLogWriter(null);
-      System.setProperty("loggerLevel", loggerLevel);
-      System.setProperty("loggerFile", loggerFile);
-    }
-  }
-
-  @Test
-  public void testSetLogStream() throws Exception {
-    // this is a dummy to make sure TestUtil is initialized
-    Connection con = DriverManager.getConnection(TestUtil.getURL(), TestUtil.getUser(), TestUtil.getPassword());
-    con.close();
-    String loggerLevel = System.getProperty("loggerLevel");
-    String loggerFile = System.getProperty("loggerFile");
-
-    try {
-      DriverManager.setLogStream(new NullOutputStream(System.err));
-      System.clearProperty("loggerFile");
-      System.clearProperty("loggerLevel");
-      Properties props = new Properties();
-      props.setProperty("user", TestUtil.getUser());
-      props.setProperty("password", TestUtil.getPassword());
-      props.setProperty("loggerLevel", "DEBUG");
-      con = DriverManager.getConnection(TestUtil.getURL(), props);
-
-      Logger logger = Logger.getLogger("org.postgresql");
-      Handler []handlers = logger.getHandlers();
-      assertTrue( handlers[0] instanceof WriterHandler );
-      con.close();
-    } finally {
-      DriverManager.setLogStream(null);
-      System.setProperty("loggerLevel", loggerLevel);
-      System.setProperty("loggerFile", loggerFile);
-    }
-  }
 }
Index: src/postgresql-jdbc-42.2-10.src/pgjdbc/src/test/java/org/postgresql/test/jdbc2/PGPropertyTest.java
===================================================================
--- src.orig/postgresql-jdbc-42.2-10.src/pgjdbc/src/test/java/org/postgresql/test/jdbc2/PGPropertyTest.java
+++ src/postgresql-jdbc-42.2-10.src/pgjdbc/src/test/java/org/postgresql/test/jdbc2/PGPropertyTest.java
@@ -8,7 +8,6 @@ package org.postgresql.test.jdbc2;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertSame;
 import static org.junit.Assert.assertTrue;
 
@@ -204,15 +203,6 @@ public class PGPropertyTest {
   }
 
   @Test
-  public void testNullValue() {
-    Properties empty = new Properties();
-    assertNull(PGProperty.LOGGER_LEVEL.getSetString(empty));
-    Properties withLogging = new Properties();
-    withLogging.setProperty(PGProperty.LOGGER_LEVEL.getName(), "OFF");
-    assertNotNull(PGProperty.LOGGER_LEVEL.getSetString(withLogging));
-  }
-
-  @Test
   public void testEncodedUrlValues() {
     String databaseName = "d&a%ta+base";
     String userName = "&u%ser";
Index: src/postgresql-jdbc-42.2-10.src/pgjdbc/src/test/java/org/postgresql/test/jdbc4/Jdbc4TestSuite.java
===================================================================
--- src.orig/postgresql-jdbc-42.2-10.src/pgjdbc/src/test/java/org/postgresql/test/jdbc4/Jdbc4TestSuite.java
+++ src/postgresql-jdbc-42.2-10.src/pgjdbc/src/test/java/org/postgresql/test/jdbc4/Jdbc4TestSuite.java
@@ -23,7 +23,6 @@ import org.junit.runners.Suite;
     DatabaseMetaDataTest.class,
     IsValidTest.class,
     JsonbTest.class,
-    LogTest.class,
     PGCopyInputStreamTest.class,
     UUIDTest.class,
     WrapperTest.class,
Index: src/postgresql-jdbc-42.2-10.src/pgjdbc/src/test/java/org/postgresql/test/jdbc4/LogTest.java
===================================================================
--- src.orig/postgresql-jdbc-42.2-10.src/pgjdbc/src/test/java/org/postgresql/test/jdbc4/LogTest.java
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Copyright (c) 2007, PostgreSQL Global Development Group
- * See the LICENSE file in the project root for more information.
- */
-
-package org.postgresql.test.jdbc4;
-
-import org.postgresql.PGProperty;
-import org.postgresql.test.TestUtil;
-import org.postgresql.test.jdbc2.BaseTest4;
-
-import org.junit.Assert;
-import org.junit.Assume;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-
-import java.sql.Array;
-import java.sql.PreparedStatement;
-import java.sql.ResultSet;
-import java.sql.SQLException;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Properties;
-
-@RunWith(Parameterized.class)
-public class LogTest extends BaseTest4 {
-
-  private String oldLevel;
-
-  public LogTest(BinaryMode binaryMode) {
-    setBinaryMode(binaryMode);
-    long maxMemory = Runtime.getRuntime().maxMemory();
-    if (maxMemory < 6L * 1024 * 1024 * 1024) {
-      // TODO: add hamcrest matches and replace with "greaterThan" or something like that
-      Assume.assumeTrue(
-          "The test requires -Xmx6g or more. MaxMemory is " + (maxMemory / 1024.0 / 1024) + " MiB",
-          false);
-    }
-  }
-
-  @Parameterized.Parameters(name = "binary = {0}")
-  public static Iterable<Object[]> data() {
-    Collection<Object[]> ids = new ArrayList<Object[]>();
-    for (BinaryMode binaryMode : BinaryMode.values()) {
-      ids.add(new Object[]{binaryMode});
-    }
-    return ids;
-  }
-
-  @Override
-  protected void updateProperties(Properties props) {
-    super.updateProperties(props);
-    PGProperty.LOGGER_LEVEL.set(props, "TRACE");
-  }
-
-  @Test
-  public void reallyLargeArgumentsBreaksLogging() throws SQLException {
-    String[] largeInput = new String[220];
-    String largeString = String.format("%1048576s", " ");
-    for (int i = 0; i < largeInput.length; i++) {
-      largeInput[i] = largeString;
-    }
-    Array arr = con.createArrayOf("text", largeInput);
-    PreparedStatement ps = con.prepareStatement("select t from unnest(?::text[]) t");
-    ps.setArray(1, arr);
-    ResultSet rs = ps.executeQuery();
-    int x = 0;
-    while (rs.next()) {
-      x += 1;
-      String found = rs.getString(1);
-      Assert.assertEquals(largeString, found);
-    }
-    Assert.assertEquals(largeInput.length, x);
-    TestUtil.closeQuietly(rs);
-    TestUtil.closeQuietly(ps);
-  }
-}
