FWD » Core Development » Runtime Infrastructure

Outside code can use CentralLogger to create an instance of any com.goldencode or anonymous (root) logger and use it to log in the name of that logger pretending to be the original source of the message.

The flexibility of having multiple instances of the same logger is a basic feature in the Java logging framework that was implemented even better with CentralLogger allowing consistent behavior between instances and after garbage collection.

Classloaders allow replacing of classes, so in theory it should be difficult to confirm the source of a method call is the original FWD framework class, even if there is a check for the caller class.

If Java 11 modules are used to wrap all FWD classes and expose a Facade (or set of interfaces), then CentralLogger can be protected by exposing a wrapper factory that doesn't allow anonymous (root) loggers and verifies the name of the logger isn't from the com.goldencode package.