Failing exit code when vulns found about log4j-detect-distribution

[bdw429s]

Hi @rarkins , thanks for the reply. I'm not a Go developer so I'm not in a position to contribute. I'm a CFML dev (JVM language) who makes open source tools and there's been a lot of interest in Log4j vuln scanners-- especially since both major CF engines still used log4j 1.x when Log4Shell came out. I've played around with sevearl log4j vuln scanners and wrapped up your project inside a module of my own to make it a little easier for CF devs using CommandBox to use your scanner with a single OS-agnostic install.
https://www.forgebox.io/view/commandbox-log4j-detect

I tossed in a couple interesting features in my wrapper project above such as

• scan a list of paths
• scanning all drives
• and returning a failing exit code (based on words in the output)

I had a few ideas along the way and just thought I would pass them along to you in your ticket tracker in case you were still hacking on this. I know a few devs who will be using this for compliance scans for a while.

[rarkins]

Hi @bdw429s I think we could make this the default behavior. BTW were you interested in contributing this or any of your other ideas you've raised? Are you still using this for log4j hunting only or have you coopted it for another use?