[log4j2] intitial integration

[0roman]

@fmeum

[inferno-chromium]

Please just move one of your email to primary contact for you. We plan to start conversations with log4j team soon.

[inferno-chromium]

Can you please check the CI build failure

[inferno-chromium]

Build compile is fine now, just the archiving part is failing

+ javac -cp /out/log4j-core.jar:/out/log4j-api.jar::/usr/local/lib/jazzer_api_deploy.jar:/out /src/Log4jFuzzer.java
/src/Log4jFuzzer.java:39: error: cannot find symbol
        DefaultConfigurationBuilder configBuilder = newDefaultConfigurationBuilder();
                                                    ^
  symbol:   method newDefaultConfigurationBuilder()
  location: class Log4jFuzzer
/src/Log4jFuzzer.java:40: error: cannot access Builder
        AppenderComponentBuilder fuzzingAppender = configBuilder.newAppender("nullAppender", FileAppender.PLUGIN_NAME);
                                                                ^
  class file for org.apache.logging.log4j.plugins.util.Builder not found
2 errors
ERROR:root:Building fuzzers failed.

Can verify build works locally using https://google.github.io/oss-fuzz/advanced-topics/reproducing/#reproducing-build-failures

[jonathanmetzman]

LGTM

[jonathanmetzman]

nit: Probably should go in /work

[jonathanmetzman]

Can come in next PR

[inferno-chromium]

@garydgregory @vy @rgoers - We would like to provide fuzz testing for log4j2 as part of OSS-Fuzz.
Code Intelligence (@fmeum and @0roman) have written the fuzzer and demonstrated that is capable of finding the log4shell vulnerability. OSS-Fuzz is a community fuzzing service serving over 500 OSS projects (e.g. openssl, ffmpeg, etc). There is no new work needed here, although you can apply for rewards to maintain and improve fuzzers, please see https://google.github.io/oss-fuzz/getting-started/integration-rewards/. Thank you for maintaining this library for the community, we truly appreciate all your efforts.

[vy]

@inferno-chromium That is simply awesome! Thanks so much! As you might imagine 😅, the entire crew is swamped with other priorities. Would you mind sharing this news via an email to the [email protected] as well, please?

[inferno-chromium]

@inferno-chromium That is simply awesome! Thanks so much! As you might imagine 😅, the entire crew is swamped with other priorities. Would you mind sharing this news via an email to the [email protected] as well, please?

@vy - Yes, we plan to sync on this early Jan once fires are out. Hope you guys can relax from Christmas, thanks again for amazing work on incident response.