You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "eugene-cheverda (via GitHub)" <gi...@apache.org> on 2023/05/04 17:52:48 UTC
[GitHub] [pulsar] eugene-cheverda opened a new pull request, #20222: [improve][security] Update dependencies to use snakeyaml 2.0
eugene-cheverda opened a new pull request, #20222:
URL: https://github.com/apache/pulsar/pull/20222
<!--
### Contribution Checklist
- PR title format should be *[type][component] summary*. For details, see *[Guideline - Pulsar PR Naming Convention](https://pulsar.apache.org/contribute/develop-semantic-title/)*.
- Fill out the template below to describe the changes contributed by the pull request. That will give reviewers the context they need to do the review.
- Each pull request should address only one issue, not mix up code from multiple issues.
- Each commit in the pull request has a meaningful commit message
- Once all items of the checklist are addressed, remove the above text and this checklist, leaving only the filled out template below.
-->
<!-- Either this PR fixes an issue, -->
<!-- or this PR is one task of an issue -->
<!-- If the PR belongs to a PIP, please add the PIP link here -->
<!-- Details of when a PIP is required and how the PIP process work, please see: https://github.com/apache/pulsar/blob/master/wiki/proposals/PIP.md -->
### Motivation
<!-- Explain here the context, and why you're making that change. What is the problem you're trying to solve. -->
Fixes https://avd.aquasec.com/nvd/cve-2022-1471 caused by snakeyaml by updating all dependencies bringing it into the project
### Modifications
<!-- Describe the modifications you've done. -->
Updated jackson and prometheus dependencies, updated code to use non-deprecated EnumResolver functions
### Verifying this change
- [ ] Make sure that the change passes the CI checks.
*(Please pick either of the following options)*
This change is a trivial rework / code cleanup without any test coverage.
*(or)*
This change is already covered by existing tests, such as *(please describe tests)*.
*(or)*
This change added tests and can be verified as follows:
*(example:)*
- *Added integration tests for end-to-end deployment with large payloads (10MB)*
- *Extended integration test for recovery after broker failure*
### Does this pull request potentially affect one of the following parts:
<!-- DO NOT REMOVE THIS SECTION. CHECK THE PROPER BOX ONLY. -->
*If the box was checked, please highlight the changes*
- [x] Dependencies (add or upgrade a dependency)
- [ ] The public API
- [ ] The schema
- [ ] The default values of configurations
- [ ] The threading model
- [ ] The binary protocol
- [ ] The REST endpoints
- [ ] The admin CLI options
- [ ] The metrics
- [ ] Anything that affects deployment
### Documentation
<!-- DO NOT REMOVE THIS SECTION. CHECK THE PROPER BOX ONLY. -->
- [ ] `doc` <!-- Your PR contains doc changes. -->
- [ ] `doc-required` <!-- Your PR changes impact docs and you will update later -->
- [x] `doc-not-needed` <!-- Your PR changes do not impact docs -->
- [ ] `doc-complete` <!-- Docs have been already added -->
### Matching PR in forked repository
PR in forked repository: <!-- ENTER URL HERE -->
<!--
After opening this PR, the build in apache/pulsar will fail and instructions will
be provided for opening a PR in the PR author's forked repository.
apache/pulsar pull requests should be first tested in your own fork since the
apache/pulsar CI based on GitHub Actions has constrained resources and quota.
GitHub Actions provides separate quota for pull requests that are executed in
a forked repository.
The tests will be run in the forked repository until all PR review comments have
been handled, the tests pass and the PR is approved by a reviewer.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] eugene-cheverda commented on pull request #20222: [fix][sec] Update dependencies to use snakeyaml 2.0
Posted by "eugene-cheverda (via GitHub)" <gi...@apache.org>.
eugene-cheverda commented on PR #20222:
URL: https://github.com/apache/pulsar/pull/20222#issuecomment-1536399374
> There's a corner regression by Jackson 2.15. It will affect our json schema. We will need to talk about it this in the dev mail list. [FasterXML/jackson-databind#3874](https://github.com/FasterXML/jackson-databind/issues/3874)
@mattisonchao So is my understanding correct that wherever `@JsonIgnore` is used with private transient fields we need to make sure that they're not getting serialized with 2.15.0?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] eugene-cheverda commented on pull request #20222: [fix][sec] Update dependencies to use snakeyaml 2.0
Posted by "eugene-cheverda (via GitHub)" <gi...@apache.org>.
eugene-cheverda commented on PR #20222:
URL: https://github.com/apache/pulsar/pull/20222#issuecomment-1536822913
Here's the gist, for future discussion, that reproduces regression for regular class, lombok.Data annotated class and lombok.Value annotated class https://gist.github.com/eugene-cheverda/e3370304895ada1048fc210d0261d853
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] tisonkun commented on pull request #20222: [fix][sec] Update dependencies to use snakeyaml 2.0
Posted by "tisonkun (via GitHub)" <gi...@apache.org>.
tisonkun commented on PR #20222:
URL: https://github.com/apache/pulsar/pull/20222#issuecomment-1654127009
Resolved by https://github.com/apache/pulsar/pull/20085.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] tisonkun commented on pull request #20222: [fix][sec] Update dependencies to use snakeyaml 2.0
Posted by "tisonkun (via GitHub)" <gi...@apache.org>.
tisonkun commented on PR #20222:
URL: https://github.com/apache/pulsar/pull/20222#issuecomment-1583018508
I remember that the client doesn't use snakeyaml actually. Maybe you can try exclude the dependency from shaded result so we get rid of all these things.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [fix][sec] Update dependencies to use snakeyaml 2.0 [pulsar]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on PR #20222:
URL: https://github.com/apache/pulsar/pull/20222#issuecomment-2508003336
already resolved with #20085
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] github-actions[bot] commented on pull request #20222: [fix][sec] Update dependencies to use snakeyaml 2.0
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #20222:
URL: https://github.com/apache/pulsar/pull/20222#issuecomment-1700226906
The pr had no activity for 30 days, mark with Stale label.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] github-actions[bot] commented on pull request #20222: [fix][sec] Update dependencies to use snakeyaml 2.0
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #20222:
URL: https://github.com/apache/pulsar/pull/20222#issuecomment-1627574549
The pr had no activity for 30 days, mark with Stale label.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] eugene-cheverda commented on pull request #20222: [fix][sec] Update dependencies to use snakeyaml 2.0
Posted by "eugene-cheverda (via GitHub)" <gi...@apache.org>.
eugene-cheverda commented on PR #20222:
URL: https://github.com/apache/pulsar/pull/20222#issuecomment-1538583109
Regression changes behavior in the following cases:
1. For regular class, `@Data` annotated the following definition of json property is not serialized in `2.14.2`, gets serialized in `2.15.0`:
```java
@JsonIgnore
private transient String field4;
public String getField4() {
return field4;
}
public void setField4(String field4) {
this.field4 = field4;
}
```
2. For `@Value` annotated class the following definitions of json property are not serialized in `2.14.2`, get serialized in `2.15.0`:
```java
@JsonIgnore
private transient String field3;
@JsonIgnore
private transient String field4;
public String getField4() {
return field4;
}
```
The most notable discrepancy in behavior between `@Data` and `@Value` annotated classes. The following property will be excluded for `@Data` and will be included in `@Value` class:
```java
@JsonIgnore
private transient String field3;
```
i.e. for `@Data` annotated class `@JsonIgnore` is being propagated to the generated property, for `@Value` class it is not.
Speaking about usages of `@JsonIgnore` and private transient field in pulsar code, please see the list below:
- https://github.com/apache/pulsar/blob/e956db729f5098ff319237fd4220dbfb234c1b18/pulsar-common/src/main/java/org/apache/pulsar/client/impl/schema/SchemaInfoImpl.java#L73
- https://github.com/apache/pulsar/blob/e956db729f5098ff319237fd4220dbfb234c1b18/pulsar-client/src/main/java/org/apache/pulsar/client/impl/conf/ClientConfigurationData.java#L62
- https://github.com/apache/pulsar/blob/e956db729f5098ff319237fd4220dbfb234c1b18/pulsar-client/src/main/java/org/apache/pulsar/client/impl/conf/ProducerConfigurationData.java#L177
- https://github.com/apache/pulsar/blob/e956db729f5098ff319237fd4220dbfb234c1b18/pulsar-client/src/main/java/org/apache/pulsar/client/impl/conf/ConsumerConfigurationData.java#L255
- https://github.com/apache/pulsar/blob/e956db729f5098ff319237fd4220dbfb234c1b18/pulsar-client/src/main/java/org/apache/pulsar/client/impl/conf/ConsumerConfigurationData.java#L386
- https://github.com/apache/pulsar/blob/e956db729f5098ff319237fd4220dbfb234c1b18/pulsar-client/src/main/java/org/apache/pulsar/client/impl/conf/ConsumerConfigurationData.java#L395
All of the above occurrences are in `@Data` annotated classes, hence the behavior matches to the one in `2.14.2`, the absence of mentioned properties is covered in tests in PR
If this PR gets approved/merged, I'll cherry-pick additional changes into PR agains `branch-3.0`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] mattisonchao commented on pull request #20222: [fix][sec] Update dependencies to use snakeyaml 2.0
Posted by "mattisonchao (via GitHub)" <gi...@apache.org>.
mattisonchao commented on PR #20222:
URL: https://github.com/apache/pulsar/pull/20222#issuecomment-1535684508
@codelipenghui @Technoboy- @lhotari @michaeljmarshall @tisonkun would you mind taking a look?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] eugene-cheverda commented on pull request #20222: [fix][sec] Update dependencies to use snakeyaml 2.0
Posted by "eugene-cheverda (via GitHub)" <gi...@apache.org>.
eugene-cheverda commented on PR #20222:
URL: https://github.com/apache/pulsar/pull/20222#issuecomment-1542267781
Hi @mattisonchao did you have a chance to discuss this in dev mail group? TIA
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] tisonkun closed pull request #20222: [fix][sec] Update dependencies to use snakeyaml 2.0
Posted by "tisonkun (via GitHub)" <gi...@apache.org>.
tisonkun closed pull request #20222: [fix][sec] Update dependencies to use snakeyaml 2.0
URL: https://github.com/apache/pulsar/pull/20222
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [fix][sec] Update dependencies to use snakeyaml 2.0 [pulsar]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari closed pull request #20222: [fix][sec] Update dependencies to use snakeyaml 2.0
URL: https://github.com/apache/pulsar/pull/20222
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org