From 2a5e41f7a85cd57f428cf34ed3433a647e4957ba Mon Sep 17 00:00:00 2001
From: "Piotr P. Karwasz" <pkarwasz-github@apache.org>
Date: Sun, 30 Aug 2026 11:29:48 +0200
Subject: [PATCH 1/2] docs: document location restrictions on Log4j 1 external
 entities

Since version 2.27.0 (#4198), the external subset and other external
entities in Log4j 1 XML configuration files are resolved through
`ConfigurationSource`, so they can only be retrieved from locations
allowed by the `log4j2.configurationAllowedProtocols` property.
Document this in the migration guide and in the Javadoc of the bridge
`XmlConfiguration`.

Assisted-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LNsw2hhNuJ6tjsEU2tChnn
---
 .../main/java/org/apache/log4j/xml/XmlConfiguration.java   | 7 +++++++
 .../antora/modules/ROOT/pages/migrate-from-log4j1.adoc     | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/log4j-1.2-api/src/main/java/org/apache/log4j/xml/XmlConfiguration.java b/log4j-1.2-api/src/main/java/org/apache/log4j/xml/XmlConfiguration.java
index aba6042c7ac..a9d98aebd5f 100644
--- a/log4j-1.2-api/src/main/java/org/apache/log4j/xml/XmlConfiguration.java
+++ b/log4j-1.2-api/src/main/java/org/apache/log4j/xml/XmlConfiguration.java
@@ -18,6 +18,7 @@
 
 import java.io.IOException;
 import java.io.InterruptedIOException;
+import java.net.URI;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Properties;
@@ -77,6 +78,12 @@
  *     Parsing and validation errors do not stop the configuration process; they are printed as warnings to the status
  *     logger.
  * </p>
+ * <p>
+ *     Since version <strong>2.27.0</strong>, external entities are resolved through
+ *     {@link ConfigurationSource#fromUri(URI)}, so they can only be retrieved from locations allowed by the
+ *     <a href="https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.configurationAllowedProtocols">{@code log4j2.configurationAllowedProtocols}</a>
+ *     configuration property.
+ * </p>
  */
 public class XmlConfiguration extends Log4j1Configuration {
 
diff --git a/src/site/antora/modules/ROOT/pages/migrate-from-log4j1.adoc b/src/site/antora/modules/ROOT/pages/migrate-from-log4j1.adoc
index a4434e1e703..901ff650d36 100644
--- a/src/site/antora/modules/ROOT/pages/migrate-from-log4j1.adoc
+++ b/src/site/antora/modules/ROOT/pages/migrate-from-log4j1.adoc
@@ -360,6 +360,13 @@ and
 xref:manual/configuration.adoc#configuration-attribute-schema[`schema`]
 attributes of the XML configuration format.
 
+[NOTE]
+====
+Since version `2.27.0`, the external subset and other external entities can only be retrieved from locations allowed by the
+xref:manual/systemproperties.adoc#log4j2.configurationAllowedProtocols[`log4j2.configurationAllowedProtocols`]
+property.
+====
+
 [#configuration-appenders]
 ==== Appenders
 

From 893d8d0aabb5410f1c4f0a76b823efd0ee027b07 Mon Sep 17 00:00:00 2001
From: "Piotr P. Karwasz" <pkarwasz-github@apache.org>
Date: Tue, 1 Sep 2026 23:20:24 +0200
Subject: [PATCH 2/2] Apply batched suggestions from code review

Co-authored-by: Ramanathan <ramanathanbscmca@gmail.com>
---
 .../src/main/java/org/apache/log4j/xml/XmlConfiguration.java    | 2 +-
 src/site/antora/modules/ROOT/pages/migrate-from-log4j1.adoc     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/log4j-1.2-api/src/main/java/org/apache/log4j/xml/XmlConfiguration.java b/log4j-1.2-api/src/main/java/org/apache/log4j/xml/XmlConfiguration.java
index a9d98aebd5f..a61f152a8fa 100644
--- a/log4j-1.2-api/src/main/java/org/apache/log4j/xml/XmlConfiguration.java
+++ b/log4j-1.2-api/src/main/java/org/apache/log4j/xml/XmlConfiguration.java
@@ -80,7 +80,7 @@
  * </p>
  * <p>
  *     Since version <strong>2.27.0</strong>, external entities are resolved through
- *     {@link ConfigurationSource#fromUri(URI)}, so they can only be retrieved from locations allowed by the
+ *     {@link ConfigurationSource#fromUri(URI)}, so they can only be retrieved from local files or over the protocols allowed by the
  *     <a href="https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.configurationAllowedProtocols">{@code log4j2.configurationAllowedProtocols}</a>
  *     configuration property.
  * </p>
diff --git a/src/site/antora/modules/ROOT/pages/migrate-from-log4j1.adoc b/src/site/antora/modules/ROOT/pages/migrate-from-log4j1.adoc
index 901ff650d36..13f3bf7c49a 100644
--- a/src/site/antora/modules/ROOT/pages/migrate-from-log4j1.adoc
+++ b/src/site/antora/modules/ROOT/pages/migrate-from-log4j1.adoc
@@ -362,7 +362,7 @@ attributes of the XML configuration format.
 
 [NOTE]
 ====
-Since version `2.27.0`, the external subset and other external entities can only be retrieved from locations allowed by the
+Since version `2.27.0`, the external subset and other external entities can only be retrieved from local files or over the protocols allowed by the
 xref:manual/systemproperties.adoc#log4j2.configurationAllowedProtocols[`log4j2.configurationAllowedProtocols`]
 property.
 ====