Remove JndiLookup.class from the SQL command line tool

[ChrisHegarty]

Elasticsearch ships with a SQL CLI Client in its bin directory. This client tool is standalone (NOT part of the server), for running ad-hoc SQL interactions. The jar containing the client is not on the servers class path. As a client tool, it does NOT accept external user input from the network, in a way that a server would typically do.

The jar containing the SQL CLI is a stand alone Java application, and can be run as such. Alternatively, the jar could also be used as a client.

This issue has been filed to consider the possible removal of JndiLookup.class from the SQL CLI jar. The mere presence of the JndiLookup.class is not problematic here, but it looks interesting and could lead to confusion for scanners, e.g.

unzip -l build/distributions/elasticsearch-sql-cli-8.1.0-SNAPSHOT.jar | grep JndiLookup
     2937  07-22-2018 20:45   org/apache/logging/log4j/core/lookup/JndiLookup.class

Alternatively, or additionally, upgrade the version of log4j that is bundled in the uber executable jar.

[ChrisHegarty]

Check if the version of log4j used by the tool the same as the server, and affected by the upgrade in #81709

[pgomulka]

I think the version of log4j in this CLI tool will be the same as we use in ES. So given we will upgrade to 2.16 in master we might not need this? Or do you want to remove JndiLookup in versions <8 ?

I tested with an upgrade to 2.16 and I got this
./gradlew -q :x-pack:plugin:sql:sql-cli:dependencies

compileClasspath - Compile classpath for source set 'main'.
...
+--- project :x-pack:plugin:sql:sql-action
...
|    +--- project :x-pack:plugin:core
|    |    +--- project :libs:elasticsearch-ssl-config
|    |    |    \--- project :libs:elasticsearch-core
...
|    |    +--- org.apache.logging.log4j:log4j-1.2-api:2.16.0
...

runtimeClasspath - Runtime classpath of source set 'main'.
...
|    \--- com.fasterxml.jackson.core:jackson-core:2.10.4
+--- project :x-pack:plugin:sql:sql-action
...
|    +--- project :x-pack:plugin:core
...
|    |    +--- org.apache.logging.log4j:log4j-1.2-api:2.16.0
...
|    +--- org.apache.logging.log4j:log4j-api:2.16.0
|    \--- org.apache.logging.log4j:log4j-core:2.16.0
...

When I extract the elasticsearch-sql-cli-8.1.0-SNAPSHOT.jar I also see 2.16 in pom files in META-INF

[elasticmachine]

Pinging @elastic/es-core-infra (Team:Core/Infra)

[elasticmachine]

Pinging @elastic/es-ql (Team:QL)