{"id":20636929,"url":"https://github.com/juergenhoetzel/log4j2go","last_synced_at":"2025-10-11T15:40:02.057Z","repository":{"id":45344172,"uuid":"439636777","full_name":"juergenhoetzel/log4j2go","owner":"juergenhoetzel","description":"A Log4J Version 2 Detector  written in golang","archived":false,"fork":false,"pushed_at":"2021-12-20T18:11:28.000Z","size":28,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-01-17T08:12:30.280Z","etag":null,"topics":["cve-2021-44228","cve-2021-45046","log4j","log4j2"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/juergenhoetzel.png","metadata":{"files":{"readme":"README.org","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-12-18T14:32:13.000Z","updated_at":"2021-12-20T18:11:30.000Z","dependencies_parsed_at":"2022-08-04T13:30:37.175Z","dependency_job_id":null,"html_url":"https://github.com/juergenhoetzel/log4j2go","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/juergenhoetzel%2Flog4j2go","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/juergenhoetzel%2Flog4j2go/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/juergenhoetzel%2Flog4j2go/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/juergenhoetzel%2Flog4j2go/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/juergenhoetzel","download_url":"https://codeload.github.com/juergenhoetzel/log4j2go/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":242656036,"owners_count":20164431,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cve-2021-44228","cve-2021-45046","log4j","log4j2"],"created_at":"2024-11-16T15:12:31.716Z","updated_at":"2025-10-11T15:39:57.030Z","avatar_url":"https://github.com/juergenhoetzel.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"[[https://github.com/juergenhoetzel/log4j2go/actions][file:https://github.com/juergenhoetzel/log4j2go/workflows/CI/badge.svg]]\n* Installation\n\n  From source:\n  #+begin_src bash\n  go install github.com/juergenhoetzel/log4j2go/cmd/log4j2go@latest\n  #+end_src\n\n  CI build Binaries for Windows, Linux and Darwin:  [[https://github.com/juergenhoetzel/log4j2go/releases][Releases · juergenhoetzel/log4j2go · GitHub]].\n* Usage\n\n  Recursively scan filesystem\n  #+begin_src bash\n  log4j2go  ~/ghq/github.com\n  #+end_src\n#+begin_src text\n2021/12/18 15:45:17 Found log4j-core-2.12.2 in \"/home/juergen/ghq/github.com/mergebase/log4j-samples/false-hits/log4j-core-2.12.2.jar\"\n2021/12/18 15:45:17 Found log4j-core-2.16.0 in \"/home/juergen/ghq/github.com/mergebase/log4j-samples/false-hits/log4j-core-2.16.0.jar\"\n2021/12/18 15:45:17 Found log4j-core-2.0-beta2 in \"/home/juergen/ghq/github.com/mergebase/log4j-samples/old-hits/log4j-core-2.0-beta2.jar\"\n2021/12/18 15:45:17 Found log4j-core-2.0-beta9 in \"/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/log4j-core-2.0-beta9.jar\"\n2021/12/18 15:45:17 Found log4j-core-2.10.0 in \"/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/log4j-core-2.10.0.jar\"\n2021/12/18 15:45:17 Found log4j-core-2.15.0 in \"/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/log4j-core-2.15.0.jar\"\n2021/12/18 15:45:17 Found log4j-core-2.9.1 in \"/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/log4j-core-2.9.1.jar\"\n2021/12/18 15:45:17 Found log4j-core-2.14.1 in \"/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/shaded/clt-1.0-SNAPSHOT.jar\"\n2021/12/18 15:45:17 Found log4j-core-2.10.0 in \"/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/springboot-executable/spiff-0.0.1-SNAPSHOT.ear!/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/springboot-executable/spiff-0.0.1-SNAPSHOT.ear!WEB-INF/lib/log4j-core-2.10.0.jar\"\n2021/12/18 15:45:17 Found log4j-core-2.10.0 in \"/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/springboot-executable/spiff-0.0.1-SNAPSHOT.jar!/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/springboot-executable/spiff-0.0.1-SNAPSHOT.jar!WEB-INF/lib/log4j-core-2.10.0.jar\"\n2021/12/18 15:45:18 Found log4j-core-2.10.0 in \"/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/springboot-executable/spiff-0.0.1-SNAPSHOT.war!/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/springboot-executable/spiff-0.0.1-SNAPSHOT.war!WEB-INF/lib/log4j-core-2.10.0.jar\"\n2021/12/18 15:45:18 Found log4j-core-2.5 in \"/home/juergen/ghq/github.com/mergebase/log4j-samples/true-hits/uber/infinispan-embedded-query-8.2.12.Final.jar\"\n#+end_src\n\n  Recursively scan root filesystem but don't descent in mountpoints\n  #+begin_src bash\n  log4j2go -samefs /\n  #+end_src\n* Performance\n\nLog4j-Detector\n#+begin_src text\ntime java -jar ~/ghq/github.com/mergebase/log4j-detector/target/log4j-detector-2021.12.17.jar ~/ghq/github.com/\n\nreal\t0m14,160s\nuser\t0m12,335s\nsys\t0m4,395s\n#+end_src\n\nLog4j2go\n#+begin_src test\ntime log4j2go  ~/ghq/github.com/\n\nreal\t0m2,844s\nuser\t0m2,738s\nsys\t0m3,553s\n#+end_src\n* How it works\n\n  =log4j2go= recursively scans the filesystem for =ear=, =war= and\n  =jar= files.  It first checks for =log4j-core/pom.xml= metadata to\n  get the version number.\n\n  If there is no =log4j-core/pom.xml= file it compares the =ZIP=\n  content for well-known Log4J2 filenames (=org/apache/logging/log4j/core= prefix) which\n  content matches the hashes from the Maven Central artefacts.  Each\n  file is also scanned recursively if it contains =jar= files.\n  \n* TODOS\n** TODO Also search in plain =.class= files\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjuergenhoetzel%2Flog4j2go","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjuergenhoetzel%2Flog4j2go","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjuergenhoetzel%2Flog4j2go/lists"}