Disable message pattern lookup by default

HMCLCore/src/main/java/org/jackhuang/hmcl/launch/DefaultLauncher.java

@@ -178,6 +178,9 @@ public class DefaultLauncher extends Launcher {
 
             res.addDefault("-Dfml.ignoreInvalidMinecraftCertificates=", "true");
             res.addDefault("-Dfml.ignorePatchDiscrepancies=", "true");
+
+            // Fix RCE vulnerability of log4j2
+            res.addDefault("-Dlog4j2.formatMsgNoLookups=", "true");
         }
 
         Proxy proxy = options.getProxy();

HMCLCore/src/main/java/org/jackhuang/hmcl/util/Logging.java

@@ -17,13 +17,14 @@
  */
 package org.jackhuang.hmcl.util;
 
+import org.jackhuang.hmcl.util.io.IOUtils;
+
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.io.PrintWriter;
 import java.io.UnsupportedEncodingException;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.text.SimpleDateFormat;
+import java.text.MessageFormat;
 import java.util.Date;
 import java.util.logging.*;
 
@@ -35,7 +36,7 @@ public final class Logging {
     }
 
     public static final Logger LOG = Logger.getLogger("HMCL");
-    private static ByteArrayOutputStream storedLogs = new ByteArrayOutputStream();
+    private static final ByteArrayOutputStream storedLogs = new ByteArrayOutputStream(IOUtils.DEFAULT_BUFFER_SIZE);
 
     public static void start(Path logFolder) {
         LOG.setLevel(Level.ALL);
@@ -93,21 +94,19 @@ public final class Logging {
     private static final class DefaultFormatter extends Formatter {
 
         static final DefaultFormatter INSTANCE = new DefaultFormatter();
-        private final SimpleDateFormat format = new SimpleDateFormat("HH:mm:ss");
+        private static final MessageFormat format = new MessageFormat("[{0,date,HH:mm:ss}] [{1}.{2}/{3}] {4}\n");
 
         @Override
         public String format(LogRecord record) {
-            String date = format.format(new Date(record.getMillis()));
-            String log = String.format("[%s] [%s.%s/%s] %s%n",
-                    date, record.getSourceClassName(), record.getSourceMethodName(),
-                    record.getLevel().getName(), record.getMessage()
-            );
-            ByteArrayOutputStream builder = new ByteArrayOutputStream();
+            String log = format.format(new Object[]{
+                    new Date(record.getMillis()),
+                    record.getSourceClassName(), record.getSourceMethodName(), record.getLevel().getName(),
+                    record.getMessage()
+            }, new StringBuffer(128), null).toString();
             if (record.getThrown() != null)
-                try (PrintWriter writer = new PrintWriter(builder)) {
-                    record.getThrown().printStackTrace(writer);
-                }
-            return log + builder.toString();
+                log += StringUtils.getStackTrace(record.getThrown());
+
+            return log;
         }
 
     }

HMCLCore/src/main/java/org/jackhuang/hmcl/util/StringUtils.java

@@ -19,9 +19,7 @@ package org.jackhuang.hmcl.util;
 
 import org.jackhuang.hmcl.util.platform.OperatingSystem;
 
-import java.io.ByteArrayOutputStream;
-import java.io.PrintStream;
-import java.io.UnsupportedEncodingException;
+import java.io.*;
 import java.nio.charset.CharsetEncoder;
 import java.nio.charset.StandardCharsets;
 import java.util.*;
@@ -37,13 +35,11 @@ public final class StringUtils {
     }
 
     public static String getStackTrace(Throwable throwable) {
-        ByteArrayOutputStream stream = new ByteArrayOutputStream();
-        try {
-            throwable.printStackTrace(new PrintStream(stream, false, "UTF-8"));
-            return stream.toString("UTF-8");
-        } catch (UnsupportedEncodingException e) {
-            throw new InternalError(e);
+        StringWriter stringWriter = new StringWriter(512);
+        try (PrintWriter printWriter = new PrintWriter(stringWriter)) {
+            throwable.printStackTrace(printWriter);
         }
+        return stringWriter.toString();
     }
 
     public static String getStackTrace(StackTraceElement[] elements) {

HMCLCore/src/main/java/org/jackhuang/hmcl/util/io/Zipper.java

@@ -80,7 +80,7 @@ public final class Zipper implements Closeable {
                 if (filter != null && !filter.test(relativePath.replace('\\', '/'))) {
                     return FileVisitResult.SKIP_SUBTREE;
                 }
-                Files.copy(file, root.resolve(relativePath));
+                Files.copy(file, root.resolve(relativePath), StandardCopyOption.COPY_ATTRIBUTES);
                 return FileVisitResult.CONTINUE;
             }
 
@@ -104,11 +104,11 @@ public final class Zipper implements Closeable {
     }
 
     public void putFile(Path file, String path) throws IOException {
-        Files.copy(file, fs.getPath(path));
+        Files.copy(file, fs.getPath(path), StandardCopyOption.COPY_ATTRIBUTES);
     }
 
     public void putStream(InputStream in, String path) throws IOException {
-        Files.copy(in, fs.getPath(path));
+        Files.copy(in, fs.getPath(path), StandardCopyOption.COPY_ATTRIBUTES);
     }
 
     public void putTextFile(String text, String path) throws IOException {

README.md

@@ -11,7 +11,9 @@ No plugin API is provided.
 ## Download
 Download the latest version [from the official website](https://hmcl.huangyuhui.net/download)
 
-Note: Github releases are outdated.
+Note: The recent versions in Github release is the beta version, which contains extra testing functions compared to the release versions on the official website. However, they may be unstable and you're more likely to encounter bugs or unexpected problems.
+
+If not necessary, it is recommended to download the ones from the official website.
 
 ## License
 The software is distributed under [GPL v3](https://www.gnu.org/licenses/gpl-3.0.html) with additional terms.