search

google / log4jscanner

A log4j vulnerability filesystem scanner and Go package for analyzing JAR files.
Apache License 2.0
1.57k stars 120 forks source link

Rewrite should back up the original jar(s) by default #13

Open mslinn opened 2 years ago

mslinn commented 2 years ago

Tools that offer to fix things without backing up the originals can create a problem if the process dies unexpectedly. The original jar(s) should be saved by default, perhaps with a .jar.save suffix.

There could be an option to suppress the backup, for the brave, the foolish, and for dev/test.

ericchiang commented 2 years ago

Would be okay with this behind a flag. On other systems, we run this continuously, and we don't want to continually detect the backup. Maybe something like:

-b --backup   Suffix to use to backup a file when rewriting (.bak)

So you could supply

log4jscanner --rewrite --backup '.save' /
mslinn commented 2 years ago

LGTM

karchx commented 2 years ago

That problem has already been solved or can I try to take care of it?

mslinn commented 2 years ago

The current HEAD shows log4jscanner.go does not contain a -b / --backup option. The way @ericchiang worded his response above, it would seem that the option was only discussed and no-one took on the job.

Go for it!

karchx commented 2 years ago

Greetings @ericchiang, with a simple query, for the functions used in the backup, do I put it in the jar / backup.go directory or create a separate directory?