From 99c07787fbbebbd705e3060302f4e49ac49c002a Mon Sep 17 00:00:00 2001
From: Mikolaj Izdebski <mizdebsk@redhat.com>
Date: Mon, 28 Jun 2021 12:58:58 +0200
Subject: [PATCH] Disable deprecated log4j logging functionality

Resolves: rhbz#1976978
---
 ant.spec | 32 ++++++++++++--------------------
 1 file changed, 12 insertions(+), 20 deletions(-)

diff --git a/ant.spec b/ant.spec
index d006268..5553df8 100644
--- a/ant.spec
+++ b/ant.spec
@@ -67,7 +67,6 @@ BuildRequires:  mvn(commons-net:commons-net)
 BuildRequires:  mvn(javax.mail:mail)
 BuildRequires:  mvn(jdepend:jdepend)
 BuildRequires:  mvn(junit:junit)
-BuildRequires:  mvn(log4j:log4j:1.2.13)
 BuildRequires:  mvn(org.tukaani:xz)
 BuildRequires:  mvn(oro:oro)
 BuildRequires:  mvn(regexp:regexp)
@@ -209,16 +208,6 @@ Optional apache bcel tasks for %{name}.
 %description apache-bcel -l fr
 Taches apache bcel optionelles pour %{name}.
 
-%package apache-log4j
-Summary:        Optional apache log4j tasks for %{name}
-Requires:       %{name} = %{version}-%{release}
-
-%description apache-log4j
-Optional apache log4j tasks for %{name}.
-
-%description apache-log4j -l fr
-Taches apache log4j optionelles pour %{name}.
-
 %package apache-oro
 Summary:        Optional apache oro tasks for %{name}
 Requires:       %{name} = %{version}-%{release}
@@ -349,11 +338,16 @@ rm src/tests/junit/org/apache/tools/ant/types/selectors/SignedSelectorTest.java
    src/tests/junit/org/apache/tools/ant/taskdefs/JarTest.java \
    src/tests/junit/org/apache/tools/mail/MailMessageTest.java
 
+# Log4jListener is deprecated by upstream: Apache Log4j (1) is not
+# developed any more. Last release is 1.2.17 from 26 May 2012 and
+# contains vulnerability issues.
+rm src/main/org/apache/tools/ant/listener/Log4jListener.java
+
 #install jars
 %if %{with bootstrap}
 build-jar-repository -s -p lib/optional javapackages-bootstrap/junit javapackages-bootstrap/hamcrest-core
 %else
-build-jar-repository -s -p lib/optional antlr bcel javamail/mailapi jdepend junit log4j-1 oro regexp bsf commons-logging commons-net jsch xalan-j2 xml-commons-resolver xalan-j2-serializer hamcrest/core hamcrest/library xz-java junit5 opentest4j
+build-jar-repository -s -p lib/optional antlr bcel javamail/mailapi jdepend junit oro regexp bsf commons-logging commons-net jsch xalan-j2 xml-commons-resolver xalan-j2-serializer hamcrest/core hamcrest/library xz-java junit5 opentest4j
 %endif
 
 # fix hardcoded paths in ant script and conf
@@ -392,9 +386,11 @@ mkdir man
 asciidoc -b docbook -d manpage -o man/%{name}.xml %{SOURCE3}
 xmlto man man/%{name}.xml -o man
 
-#remove empty jai and netrexx jars. Due to missing dependencies they contain only manifests.
+# remove empty jai and netrexx jars. Due to missing dependencies they contain only manifests.
 rm -fr build/lib/ant-jai.jar build/lib/ant-netrexx.jar
-# -----------------------------------------------------------------------------
+# log4j logging is deprecated
+rm build/lib/ant-apache-log4j.jar
+
 
 %install
 # ANT_HOME and subdirs
@@ -483,7 +479,6 @@ echo "xml-commons-resolver ant/ant-apache-resolver" > $RPM_BUILD_ROOT%{_sysconfd
 echo "apache-commons-logging ant/ant-commons-logging" > $RPM_BUILD_ROOT%{_sysconfdir}/%{name}.d/commons-logging
 echo "apache-commons-net ant/ant-commons-net" > $RPM_BUILD_ROOT%{_sysconfdir}/%{name}.d/commons-net
 echo "bcel ant/ant-apache-bcel" > $RPM_BUILD_ROOT%{_sysconfdir}/%{name}.d/apache-bcel
-echo "log4j12 ant/ant-apache-log4j" > $RPM_BUILD_ROOT%{_sysconfdir}/%{name}.d/apache-log4j
 echo "oro ant/ant-apache-oro" > $RPM_BUILD_ROOT%{_sysconfdir}/%{name}.d/apache-oro
 echo "regexp ant/ant-apache-regexp" > $RPM_BUILD_ROOT%{_sysconfdir}/%{name}.d/apache-regexp
 echo "xalan-j2 xalan-j2-serializer ant/ant-apache-xalan2" > $RPM_BUILD_ROOT%{_sysconfdir}/%{name}.d/apache-xalan2
@@ -585,10 +580,6 @@ LC_ALL=C.UTF-8 %{ant} test
 %{ant_home}/lib/%{name}-apache-bcel.jar
 %config(noreplace) %{_sysconfdir}/%{name}.d/apache-bcel
 
-%files apache-log4j -f .mfiles-apache-log4j
-%{ant_home}/lib/%{name}-apache-log4j.jar
-%config(noreplace) %{_sysconfdir}/%{name}.d/apache-log4j
-
 %files apache-oro -f .mfiles-apache-oro
 %{ant_home}/lib/%{name}-apache-oro.jar
 %config(noreplace) %{_sysconfdir}/%{name}.d/apache-oro
@@ -645,7 +636,8 @@ LC_ALL=C.UTF-8 %{ant} test
 # -----------------------------------------------------------------------------
 
 %changelog
-* Mon Jun 21 2021 Mikolaj Izdebski <mizdebsk@redhat.com> - 1.10.9-6
+* Mon Jun 28 2021 Mikolaj Izdebski <mizdebsk@redhat.com> - 1.10.9-6
+- Disable deprecated log4j logging functionality
 - Remove support for JavaScript
 
 * Wed Jun 09 2021 Mikolaj Izdebski <mizdebsk@redhat.com> - 1.10.9-5