Exclude end-of-life log4j 1.x from the flogger backend Adding the CycloneDX SBOM scan for gitiles (//:gitiles_sbom_scan, Trivy over the generated SBOM) surfaced log4j:log4j 1.2.15 shipping in gitiles.war with six CVEs, three of them CRITICAL: CVE-2019-17571, CVE-2022-23305 and CVE-2022-23307, plus CVE-2021-4104, CVE-2022-23302 and CVE-2023-26464. This is end-of-life log4j 1.x with no fixed release. flogger-log4j-backend pulls log4j:log4j in transitively. reload4j, the patched drop-in fork, is already a direct dependency and provides the same classes, so exclude log4j:log4j from the backend's transitive closure and re-pin. gitiles.war now ships reload4j-1.2.26.jar alone; the vulnerable log4j-1.2.15.jar is gone. Gerrit keeps log4j 1.x out the same way. Change-Id: I09b20eb11cae70acec87cccf96b82acf1f0eb3c6
Gitiles is a simple repository browser for Git repositories, built on JGit. Its guiding principle is simplicity: it has no formal access controls, no write access, no fancy Javascript, etc.
Gitiles automatically renders *.md Markdown files into HTML for simplified documentation. Refer to the Markdown documentation for details.
Gitiles is configurable in a git-style configuration file named gitiles.config. Refer to the configuration documentation for details.
Use gerrit's issue tracker to file bugs.
Please refer to the Developer Guide.