As noted in the docs it's possible to disable this behavior with:

Log::Log4perl::Config->allow_code(0);
[download]

So it's insecure by default. Not nice.

And the same is true for the next documented feature, Log::Log4perl::Config->allowed_code_ops(...). Quoting the documentation:

By default, a value of '1' is assumed, which does a normal 'eval' without any restrictions.

Insecure by default, you have to lock it down explicitly. Again, not nice.

Alexander