You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@inlong.apache.org by "H0924cc (via GitHub)" <gi...@apache.org> on 2023/08/11 15:32:14 UTC

[GitHub] [inlong] H0924cc opened a new pull request, #8708: [INLONG-8685][Sort] Denial of Service due to parser crash

H0924cc opened a new pull request, #8708:
URL: https://github.com/apache/inlong/pull/8708

   ### Prepare a Pull Request
   
   - [INLONG-8685][Sort] Denial of Service due to parser crash
   
   - Fixes #8685
   
   ### Motivation
   
   Those using FasterXML/woodstox to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
   This vulnerability is only relevant for users making use of the DD parsing functionality.
   
   ### Modifications
   
   Upgrade com.fasterxml.woodstox:woodstox-core to version 5.4.0 to fix 1 Dependabot alert in inlong-sort/sort-flink/sort-flink-v1.13/sort-connectors/hudi/pom.xml.
   
   ### Verifying this change
   
   - [ ] This change is a trivial rework/code cleanup without any test coverage.
   
   ### Documentation
   
     - Does this pull request introduce a new feature?  no
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@inlong.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [inlong] H0924cc closed pull request #8708: [INLONG-8685][Sort] Denial of Service due to parser crash

Posted by "H0924cc (via GitHub)" <gi...@apache.org>.
H0924cc closed pull request #8708: [INLONG-8685][Sort] Denial of Service due to parser crash
URL: https://github.com/apache/inlong/pull/8708


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@inlong.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [inlong] EMsnap commented on a diff in pull request #8708: [INLONG-8685][Sort] Denial of Service due to parser crash

Posted by "EMsnap (via GitHub)" <gi...@apache.org>.
EMsnap commented on code in PR #8708:
URL: https://github.com/apache/inlong/pull/8708#discussion_r1292914370


##########
inlong-sort/sort-flink/sort-flink-v1.13/sort-connectors/hudi/pom.xml:
##########
@@ -80,7 +80,7 @@
         <dependency>
             <groupId>com.fasterxml.woodstox</groupId>
             <artifactId>woodstox-core</artifactId>
-            <version>${woodstox-core.version}</version>

Review Comment:
   Maybe reuse ${woodstox-core.version} is a better idea 



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@inlong.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org