Link to information about serialization security issues
@@ -30,9 +30,9 @@ import org.apache.logging.log4j.core.config.plugins.PluginFactory;
/**
* Formats a {@link LogEvent} in its Java serialized form.
*
- * @deprecated Java Serialization has inherent security weaknesses, using this layout is no longer recommended.
- * An alternative layout containing the same information is {@link JsonLayout} when configured with properties="true".
- * Deprecated since 2.9.
+ * @deprecated Java Serialization has inherent security weaknesses, see https://www.owasp.org/index.php/Deserialization_of_untrusted_data .
+ * Using this layout is no longer recommended. An alternative layout containing the same information is
+ * {@link JsonLayout} when configured with properties="true". Deprecated since 2.9.
*/
@Deprecated
@Plugin(name = "SerializedLayout", category = Node.CATEGORY, elementType = Layout.ELEMENT_TYPE, printObject = true)
@@ -52,7 +52,7 @@ public final class SerializedLayout extends AbstractLayout<LogEvent> {
private SerializedLayout() {
super(null, null, null);
- LOGGER.warn("SerializedLayout is deprecated due to the inherent security weakness in Java Serialization. Consider using another layout, e.g. JsonLayout");
+ LOGGER.warn("SerializedLayout is deprecated due to the inherent security weakness in Java Serialization, see https://www.owasp.org/index.php/Deserialization_of_untrusted_data Consider using another layout, e.g. JsonLayout");
}
/**
