Harden log4net against the findings of a security audit - #310

Merged

FreeAndNil merged 22 commits into

masterfrom

Feature/security-audit-hardening

Aug 18, 2026

Commits on Aug 17, 2026

report the first appender error without log4net.Internal.Debug

FreeAndNil
and
claude
committed
ecd1b8b
contain per-event failures in AdoNetAppender.SendBuffer

FreeAndNil
and
claude
committed
9f5c955
warn when AdoNetAppender executes layout-generated SQL

FreeAndNil
and
claude
committed
19fdb4a
time out writes to stalled TelnetAppender clients

FreeAndNil
and
claude
committed
2fb4539
redact the password when reporting a failed database connection

FreeAndNil
and
claude
committed
e80b381
document that configuration is trusted input

FreeAndNil
and
claude
committed
6bc3df3
add a TransportSecurity option to the MailKit SmtpAppender

FreeAndNil
and
claude
committed
bd35fe0
escape NUL characters in LocalSyslogAppender messages

FreeAndNil
and
claude
committed
eccb876
report a RemoteSyslogAppender Identity that would split the record

FreeAndNil
and
claude
committed
46582e5
bound regular expression matching in the string match filters

FreeAndNil
and
claude
committed
394fd3d
flush TextWriterAppender under the appender lock

FreeAndNil
and
claude
committed
86ecb15
keep the impersonated user name when a logging event is fixed

FreeAndNil
and
claude
committed
1786b13
document that format strings are trusted developer input

FreeAndNil
and
claude
committed
287fa9c
make the release verification scripts fail closed

FreeAndNil
and
claude
committed
9cc34d2
fix the lifetime of the LocalSyslogAppender identity

FreeAndNil
and
claude
committed
360a102
bound the waits for the file locking mutexes

FreeAndNil
and
claude
committed
3fd97cb
add a listen address to TelnetAppender

FreeAndNil
and
claude
committed
15d16ee
pin the Maven wrapper and distribution downloads

FreeAndNil
and
claude
committed
28d411a
remove the git-broadcast workflow

FreeAndNil
and
claude
committed
e203b7c
document the conventions the security scan work relied on #309
FreeAndNil
committed
dc17e1b

Commits on Aug 18, 2026

New PR number (#310)
FreeAndNil
committed
1c664f8
fix AcquireLockGivesUpWhenTheLockIsHeldTooLong on Windows #310
FreeAndNil
committed
843ccfc

Navigation Menu

Uh oh!

Uh oh!

Harden log4net against the findings of a security audit - #310

Harden log4net against the findings of a security audit#310
FreeAndNil merged 22 commits into
masterfrom
Feature/security-audit-hardening

Commits on Aug 17, 2026

report the first appender error without log4net.Internal.Debug

contain per-event failures in AdoNetAppender.SendBuffer

warn when AdoNetAppender executes layout-generated SQL

time out writes to stalled TelnetAppender clients

redact the password when reporting a failed database connection

document that configuration is trusted input

add a TransportSecurity option to the MailKit SmtpAppender

escape NUL characters in LocalSyslogAppender messages

report a RemoteSyslogAppender Identity that would split the record

bound regular expression matching in the string match filters

flush TextWriterAppender under the appender lock

keep the impersonated user name when a logging event is fixed

document that format strings are trusted developer input

make the release verification scripts fail closed

fix the lifetime of the LocalSyslogAppender identity

bound the waits for the file locking mutexes

add a listen address to TelnetAppender

pin the Maven wrapper and distribution downloads

remove the git-broadcast workflow

document the conventions the security scan work relied on #309

Commits on Aug 18, 2026

New PR number (#310)

fix AcquireLockGivesUpWhenTheLockIsHeldTooLong on Windows #310