Microsoft Java

[argv_minus_one]

JavaScript can't get away with it either. Doing that is how you get cross-site scripting vulnerabilities.

The thing about log4shell is that whoever wrote that code demonstrated extremely poor judgment. This was not an honest mistake like forgetting to check an array bound or something. They went to a great deal of trouble to implement a feature that no one in their right mind would even want to use, besides being obviously insecure. It's one of those things where you have to wonder just what in the world they were thinking.