The class javadoc of org.apache.log4j.layout.Log4j1SyslogLayout lists an escapeNL attribute ("Pattern to use for replacing newlines"). This is a copy-paste artifact from the javadoc of o.a.l.l.core.layout.SyslogLayout. No such attribute exists on Log4j1SyslogLayout, its builder exposes no way to set one, and toSerializable() performs no newline handling at all.
The result is that an operator reading the documentation believes a mitigation is available and configurable when it is not.
Proposed change: remove the escapeNL entry from the javadoc. While there, review the rest of the attribute list for further attributes inherited from SyslogLayout's javadoc that the class does not actually implement.
This was reported by @August829.
The class javadoc of
org.apache.log4j.layout.Log4j1SyslogLayoutlists anescapeNLattribute ("Pattern to use for replacing newlines"). This is a copy-paste artifact from the javadoc ofo.a.l.l.core.layout.SyslogLayout. No such attribute exists onLog4j1SyslogLayout, its builder exposes no way to set one, andtoSerializable()performs no newline handling at all.The result is that an operator reading the documentation believes a mitigation is available and configurable when it is not.
Proposed change: remove the
escapeNLentry from the javadoc. While there, review the rest of the attribute list for further attributes inherited fromSyslogLayout's javadoc that the class does not actually implement.This was reported by @August829.