Description
It seems that Spring.NET universally logs messages using string concatenation and interpolation instead of log formatting templates. This leads to problems when applications use structured logging in general, and in particular when raw message templates are logged.
For example, if we have an NLog layout (snippet) such as this:
{
"name": "message",
"layout": "${message}"
},
{
"name": "messageTemplate",
"layout": "${message:raw=true}"
}A resulting log entry would be:
{
"time": "2025-03-17 15:55:21.5886",
"level": "DEBUG",
"logger": "Spring.Objects.Factory.Support.DefaultListableObjectFactory",
"message": "Invoking IObjectPostProcessors before initialization of object 'System.Data.OracleClient'",
"messageTemplate": "Invoking IObjectPostProcessors before initialization of object 'System.Data.OracleClient'"
}instead of the expected:
{
"time": "2025-03-17 15:55:21.5886",
"level": "DEBUG",
"logger": "Spring.Objects.Factory.Support.DefaultListableObjectFactory",
"message": "Invoking IObjectPostProcessors before initialization of object 'System.Data.OracleClient'",
"messageTemplate": "Invoking IObjectPostProcessors before initialization of object '{name}'"
}This makes template logging unusable for Spring logs (one reason to do this would be to easily categorize messages produces by a particular logging call), but, more importantly, could lead to unexpected sensitive data leakages (e.g. database connection string being logged unsanitized via the logged template because the client app does not expect actual values popping up here).