Using 3.0.0, malformed JSON log output can be trivially produced by including structured arguments with names equal to those emitted by the library itself.
Log.infov("Something from resource", kv("timestamp", "timestamp from resource");
results in log output with two properties named timestamp because that property is also added by TimestampJsonProvider.
Possible mitigation
I have several ideas about possible improvements:
The ArgumentsJsonProvider could be made aware of the (configurable) field names used by the other providers so it can
throw on duplication,
ignore on duplication or
override on duplication: User supplied structured arguments could take precedence over those generated by the library itself. This would not play nice with streaming behavior and would require a substantial change.
A configuration setting could be added to instruct the arguments provider what to do in case of duplication.
Many thanks for the great work.
Summary
Using 3.0.0, malformed JSON log output can be trivially produced by including structured arguments with names equal to those emitted by the library itself.
Repro
https://github.com/langsamu/quarkiverse-json-duplicate-structured-argument.
Example
results in log output with two properties named
timestamp
because that property is also added byTimestampJsonProvider
.Possible mitigation
I have several ideas about possible improvements:
ArgumentsJsonProvider
could be made aware of the (configurable) field names used by the other providers so it canquarkus.log.json.fields.arguments.field-name
.