Issue #2535192 by chx, dawehner, jhodgdon: Security: LoggerChannelInterface...

Issue #2535192 by chx, dawehner, jhodgdon: Security: LoggerChannelInterface doxygen needs a little love

core/lib/Drupal/Core/Logger/LoggerChannelInterface.php

@@ -13,6 +13,29 @@
 
 /**
  * Logger channel interface.
+ *
+ * This interface defines the full behavior of the central Drupal logger
+ * facility. However, when writing code that does logging, use the generic
+ * \Psr\Log\LoggerInterface for typehinting instead (you shouldn't need the
+ * methods here).
+ *
+ * To add a new logger to the system, implement \Psr\Log\LoggerInterface and
+ * add a service for that class to a services.yml file tagged with the 'logger'
+ * tag. The default logger channel implementation will call the log() method
+ * of every logger service with some useful data set in the $context argument
+ * of log(): request_uri, referer, ip, user, uid.
+ *
+ * SECURITY NOTE: the caller might also set a 'link' in the $context array
+ * which will be printed as-is by the dblog module under an "operations"
+ * header. Usually this is a "view", "edit" or similar relevant link. Make sure
+ * to use proper, secure link generation facilities; some are listed below.
+ *
+ * @see \Drupal\Core\Logger\RfcLoggerTrait
+ * @see \Psr\Log\LoggerInterface
+ * @see \Drupal\Core\Logger\\LoggerChannelFactoryInterface
+ * @see \Drupal\Core\Utility\LinkGeneratorInterface
+ * @see \Drupal\Core\Routing\LinkGeneratorTrait::l()
+ * @see \Drupal\Core\Entity\EntityInterface::link()
  */
 interface LoggerChannelInterface extends LoggerInterface {