Bobby Bissett - Javasoft wrote:
>> It's a bug in the JDK. I reported this in May 2005 (bugtraq CR
>> 6274920). It has been fixed
>> in JDK 7, but I don't think the fix has been backported to JDK 6, even
>> though I requested it.
>
> Ok, I was afraid this affected I18N in general, but I see that it's only
> related to loggers and not to resource bundles on their own.
>
> I didn't know that the loggers were "global" across the server. Maybe
> this is a "I haven't had my coffee yet" moment, but I thought separate
> applications wouldn't end up with the same instances of Logger objects,
> but now I see that they do.
>
> Fun side effect is that if two apps both use the same String for the
> logger name, one app can turn off logging for the other. That's, um,
> handy. Or you can hose your log files by dropping this in your app (just
> to pick a logger that outputs a message every couple seconds):
>
> Logger.getLogger("javax.enterprise.system.tools.deployment").setLevel(Level.FINEST);
>
>
> This smells like a security bug, but I don't think it is exactly.
If you run with a security manager, this should be restricted.