Additional output of secure log4j Versions

Hi,

the current implementation does not output secure log4j versions (for example 2.17.1) to the output files (for example csv) and to the console. After investigation in the code, it seems, there are these code fragments in file Detector.java, that prevent this:

...
if (isVulnerableLog4j2(Version.parse(log4j2Version))) {
					printDetectionForLog4j2(jarFile, pathChain, log4j2Version, log4j2Mitigated, false);

...
vulnerable = isVulnerableLog4j1(Version.parse(log4j1Version));
					if (vulnerable)
						printDetectionForLog4j1(jarFile, pathChain, log4j1Version, log4j1Mitigated);
...

Is it possible to ouput this versions as not vulnerable too (for example with a additional command line switch)?

Background: Output of not vulnerable versions is needed for build up a history in splunk.

Thank you

[xeraph]

@OrbbQ3 Would you test v3.0.1 release? You can use --report-patch option.

[ChKemper]

Hi @OrbbQ3,

I’ve done a short fix for this: #278