You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flink.apache.org by "tomncooper (via GitHub)" <gi...@apache.org> on 2024/10/24 13:57:46 UTC
[PR] [FLINK-33571][table] Backport json-path upgrade to deal with CVE [flink]
tomncooper opened a new pull request, #25573:
URL: https://github.com/apache/flink/pull/25573
## What is the purpose of the change
Currently, the `flink-table` modules uses json-path 2.7.0. This is vulnerable to CVE-2023-1370 and CVE-2023-51074.
## Brief change log
Upgrades the `com.jayway.jsonpath:json-path` version used in `flink-table` from `2.7.0` to `2.9.0`.
## Verifying this change
This change is a trivial rework / code cleanup without any test coverage.
## Does this pull request potentially affect one of the following parts:
- Dependencies (does it add or upgrade a dependency): yes
- The public API, i.e., is any changed class annotated with `@Public(Evolving)`: no
- The serializers: no
- The runtime per-record code paths (performance sensitive): no
- Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: no
- The S3 file system connector: no
## Documentation
- Does this pull request introduce a new feature? no
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-33571][table] Backport json-path upgrades to deal with CVE [flink]
Posted by "snuyanzin (via GitHub)" <gi...@apache.org>.
snuyanzin commented on code in PR #25573:
URL: https://github.com/apache/flink/pull/25573#discussion_r1857314934
##########
flink-table/flink-table-calcite-bridge/pom.xml:
##########
@@ -152,9 +152,21 @@ under the License.
<groupId>org.locationtech.proj4j</groupId>
<artifactId>proj4j</artifactId>
</exclusion>
+ <!-- Exclude json-path as we are manually overriding it to a newer version -->
+ <exclusion>
+ <groupId>com.jayway.jsonpath</groupId>
+ <artifactId>json-path</artifactId>
+ </exclusion>
</exclusions>
</dependency>
+ <!-- Override the json-path version used by Calcite 1.32 to deal with CVE-2023-1370 -->
+ <dependency>
+ <groupId>com.jayway.jsonpath</groupId>
+ <artifactId>json-path</artifactId>
+ <version>2.9.0</version>
Review Comment:
```suggestion
<version>${jsonpath.version}</version>
```
I guess we can reuse properties instead of hard coded values, can't we?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-33571][table] Backport json-path upgrade to deal with CVE [flink]
Posted by "snuyanzin (via GitHub)" <gi...@apache.org>.
snuyanzin commented on PR #25573:
URL: https://github.com/apache/flink/pull/25573#issuecomment-2496189923
can we see
```
./mvnw dependency:tree | grep json-path
```
output to be sure it is fixed?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-33571][table] Backport json-path upgrade to deal with CVE [flink]
Posted by "tomncooper (via GitHub)" <gi...@apache.org>.
tomncooper commented on PR #25573:
URL: https://github.com/apache/flink/pull/25573#issuecomment-2435518436
This is failing to build with JDK 11 but the main `release-1.20` branch also fails to build with JDK 11
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-33571][table] Backport json-path upgrade to deal with CVE [flink]
Posted by "snuyanzin (via GitHub)" <gi...@apache.org>.
snuyanzin commented on PR #25573:
URL: https://github.com/apache/flink/pull/25573#issuecomment-2497546982
if I read PR description
>Backport json-path upgrade to deal with CVE
it says that it makes it dealing with CVE and based on changes we realize it doesn't ...
I think the change should be atomic and in one PR
or did I miss anything? (currently talking about 1.20)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-33571][table] Backport json-path upgrades to deal with CVE [flink]
Posted by "snuyanzin (via GitHub)" <gi...@apache.org>.
snuyanzin commented on PR #25573:
URL: https://github.com/apache/flink/pull/25573#issuecomment-2499973345
thanks, i think we are close to merge it
i have one last comment
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-33571][table] Backport json-path upgrades to deal with CVE [flink]
Posted by "snuyanzin (via GitHub)" <gi...@apache.org>.
snuyanzin merged PR #25573:
URL: https://github.com/apache/flink/pull/25573
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-33571][table] Backport json-path upgrade to deal with CVE [flink]
Posted by "flinkbot (via GitHub)" <gi...@apache.org>.
flinkbot commented on PR #25573:
URL: https://github.com/apache/flink/pull/25573#issuecomment-2435389238
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "16b263e8fec166a065f50877b6aa9491e1c43fca",
"status" : "UNKNOWN",
"url" : "TBD",
"triggerID" : "16b263e8fec166a065f50877b6aa9491e1c43fca",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* 16b263e8fec166a065f50877b6aa9491e1c43fca UNKNOWN
<details>
<summary>Bot commands</summary>
The @flinkbot bot supports the following commands:
- `@flinkbot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-33571][table] Backport json-path upgrades to deal with CVE [flink]
Posted by "tomncooper (via GitHub)" <gi...@apache.org>.
tomncooper commented on PR #25573:
URL: https://github.com/apache/flink/pull/25573#issuecomment-2498448625
@snuyanzin I have merged the PRs for `json-path` and CI has passed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-33571][table] Backport json-path upgrade to deal with CVE [flink]
Posted by "snuyanzin (via GitHub)" <gi...@apache.org>.
snuyanzin commented on PR #25573:
URL: https://github.com/apache/flink/pull/25573#issuecomment-2497561121
I would prefer combining upgrades in one since we are going to do this to solve a pretty clear issue
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-33571][table] Backport json-path upgrade to deal with CVE [flink]
Posted by "tomncooper (via GitHub)" <gi...@apache.org>.
tomncooper commented on PR #25573:
URL: https://github.com/apache/flink/pull/25573#issuecomment-2497552524
I agree the PR description could be clearer. I can either update that or combine all the upgrades?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-33571][table] Backport json-path upgrade to deal with CVE [flink]
Posted by "tomncooper (via GitHub)" <gi...@apache.org>.
tomncooper commented on PR #25573:
URL: https://github.com/apache/flink/pull/25573#issuecomment-2450102032
@flinkbot run azure
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-33571][table] Backport json-path upgrades to deal with CVE [flink]
Posted by "tomncooper (via GitHub)" <gi...@apache.org>.
tomncooper commented on PR #25573:
URL: https://github.com/apache/flink/pull/25573#issuecomment-2501164029
Thanks @snuyanzin, I think we are good to go.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-33571][table] Backport json-path upgrade to deal with CVE [flink]
Posted by "tomncooper (via GitHub)" <gi...@apache.org>.
tomncooper commented on PR #25573:
URL: https://github.com/apache/flink/pull/25573#issuecomment-2497535764
@snuyanzin This PR only fixes the direct dependency on json-path used by `flink-table-runtime`. There is a transitive dependency on `json-path` 2.7.0 that comes from Calcite 1.32 which is used by the `flink-table-calcite-bridge`. That is dealt with for master by #25602 and backported for 1.20 in #25613.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org