Move chainsaw, net, jdbc, jmx, ... into separate artifacts

[ceki]

Vladimir Sitnikov : It would allow clients to depend on the reduced feature set, and they will be secured in face of unknown vulnerabilities

[ceki]

Comment Hannes Rosenögger:
while this would improve the security a bit, it also creates another layer of complexity.
Currently, people know that they can simply replace their log4j 1 with reload4j.

If we split it into several artifacts you first need to figure out which one you need.

Given the somewhat temporary nature of reload4j (people are still encouraged to update their apps to newer frameworks) idk if the added complexity and the time needed to create separate artifacts are worth it.

[ceki]

vladimirsitnikov Vladimir Sitnikov added a comment - 2020-01-13

My guess is that people never really need chainsaw in the application classpath, they might know they do not need networking (e.g. to avoid accidental log leak to the network services, etc).

[ceki]

Vladimir Sitnikov added a comment - 2020-01-13 There's also an option to move the code into modules, and still keep them as the default dependency of :reload4j.

Then people have the same classes by default, however, they can now exclude unwanted classes without resorting to "deleting classes from jar"

[ceki]

Moving chainsaw to a different module makes sense. As for other modules, it might be too big a change at this stage.

[rdifrango]

I think removing the Chainsaw component would be good given that there's a the following new CVE against it and its inclusion in the core jar:

https://www.cvedetails.com/cve/CVE-2022-23307/

[ceki]

@rdifrango While moving Chainsaw to a different artifact is a good idea, the CVE you mention was already fixed in 1.2.18.1

[rdifrango]

Thanks @ceki - I missed that.