You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tinkerpop.apache.org by xi...@apache.org on 2023/04/03 17:30:44 UTC
[tinkerpop] branch 3.5-dev updated: TINKERPOP-2902 bump snakeyaml to 2.0 and commons-configuration to 2.9.0
This is an automated email from the ASF dual-hosted git repository.
xiazcy pushed a commit to branch 3.5-dev
in repository https://gitbox.apache.org/repos/asf/tinkerpop.git
The following commit(s) were added to refs/heads/3.5-dev by this push:
new bc4e6abcd3 TINKERPOP-2902 bump snakeyaml to 2.0 and commons-configuration to 2.9.0
new 78d2db2d3a Merge pull request #2008 from acoady/TINKERPOP-2902
bc4e6abcd3 is described below
commit bc4e6abcd3cb40490a54d9e1766437c01f090a90
Author: Aaron Coady <ac...@ca.ibm.com>
AuthorDate: Thu Mar 30 08:46:30 2023 -0700
TINKERPOP-2902 bump snakeyaml to 2.0 and commons-configuration to 2.9.0
---
CHANGELOG.asciidoc | 2 ++
.../main/java/org/apache/tinkerpop/gremlin/driver/Settings.java | 8 +++++---
.../gremlin/groovy/jsr223/customizer/FileSandboxExtension.groovy | 4 +++-
.../main/java/org/apache/tinkerpop/gremlin/server/Settings.java | 6 ++++--
.../java/org/apache/tinkerpop/gremlin/server/authz/AllowList.java | 8 +++++---
pom.xml | 4 ++--
6 files changed, 21 insertions(+), 11 deletions(-)
diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc
index 51da27cd18..0926bbbefe 100644
--- a/CHANGELOG.asciidoc
+++ b/CHANGELOG.asciidoc
@@ -33,6 +33,8 @@ image::https://raw.githubusercontent.com/apache/tinkerpop/master/docs/static/ima
* Changed `gremlin-console` to add imports via an ImportCustomizer to reduce time spent resolving imports.
* Bumped to Groovy 2.5.21.
* Added `AuthInfoProvider` interface and `NewDynamicAuth()` to gremlin-go for dynamic authentication support.
+* Bumped to `snakeyaml` 2.0 to fix security vulnerability.
+* Bumped to Apache `commons-configuration` 2.9.0 to fix security vulnerability.
[[release-3-5-5]]
=== TinkerPop 3.5.5 (Release Date: January 16, 2023)
diff --git a/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Settings.java b/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Settings.java
index bf70da71e0..130c878788 100644
--- a/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Settings.java
+++ b/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Settings.java
@@ -21,6 +21,7 @@ package org.apache.tinkerpop.gremlin.driver;
import org.apache.commons.configuration2.Configuration;
import org.apache.tinkerpop.gremlin.driver.ser.GraphBinaryMessageSerializerV1;
import org.apache.tinkerpop.gremlin.util.iterator.IteratorUtils;
+import org.yaml.snakeyaml.LoaderOptions;
import org.yaml.snakeyaml.TypeDescription;
import org.yaml.snakeyaml.Yaml;
import org.yaml.snakeyaml.constructor.Constructor;
@@ -111,10 +112,11 @@ final class Settings {
public static Settings read(final InputStream stream) {
Objects.requireNonNull(stream);
- final Constructor constructor = new Constructor(Settings.class);
+ final LoaderOptions options = new LoaderOptions();
+ final Constructor constructor = new Constructor(Settings.class, options);
final TypeDescription settingsDescription = new TypeDescription(Settings.class);
- settingsDescription.putListPropertyType("hosts", String.class);
- settingsDescription.putListPropertyType("serializers", SerializerSettings.class);
+ settingsDescription.addPropertyParameters("hosts", String.class);
+ settingsDescription.addPropertyParameters("serializers", SerializerSettings.class);
constructor.addTypeDescription(settingsDescription);
final Yaml yaml = new Yaml(constructor);
diff --git a/gremlin-groovy/src/main/groovy/org/apache/tinkerpop/gremlin/groovy/jsr223/customizer/FileSandboxExtension.groovy b/gremlin-groovy/src/main/groovy/org/apache/tinkerpop/gremlin/groovy/jsr223/customizer/FileSandboxExtension.groovy
index 1dea3a1fd3..c50434598f 100644
--- a/gremlin-groovy/src/main/groovy/org/apache/tinkerpop/gremlin/groovy/jsr223/customizer/FileSandboxExtension.groovy
+++ b/gremlin-groovy/src/main/groovy/org/apache/tinkerpop/gremlin/groovy/jsr223/customizer/FileSandboxExtension.groovy
@@ -20,6 +20,7 @@ package org.apache.tinkerpop.gremlin.groovy.jsr223.customizer
import org.slf4j.Logger
import org.slf4j.LoggerFactory
+import org.yaml.snakeyaml.LoaderOptions
import org.yaml.snakeyaml.TypeDescription
import org.yaml.snakeyaml.Yaml
import org.yaml.snakeyaml.constructor.Constructor
@@ -101,7 +102,8 @@ class FileSandboxExtension extends AbstractSandboxExtension {
public Map<String,String> staticVariableTypes
public static Settings read(final File file) throws Exception {
- final Constructor constructor = new Constructor(Settings.class)
+ final LoaderOptions options = new LoaderOptions()
+ final Constructor constructor = new Constructor(Settings.class, options)
final TypeDescription settingsDescription = new TypeDescription(Settings.class)
settingsDescription.putListPropertyType("methodWhiteList", String.class)
settingsDescription.putMapPropertyType("staticVariableTypes", String.class, String.class)
diff --git a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/Settings.java b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/Settings.java
index 149372f655..3ec50a550e 100644
--- a/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/Settings.java
+++ b/gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/Settings.java
@@ -37,6 +37,7 @@ import org.apache.tinkerpop.gremlin.server.util.LifeCycleHook;
import org.apache.tinkerpop.gremlin.structure.Graph;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import org.yaml.snakeyaml.LoaderOptions;
import org.yaml.snakeyaml.TypeDescription;
import org.yaml.snakeyaml.Yaml;
import org.yaml.snakeyaml.constructor.Constructor;
@@ -336,7 +337,8 @@ public class Settings {
* @return a {@link Constructor} to parse a Gremlin Server YAML
*/
protected static Constructor createDefaultYamlConstructor() {
- final Constructor constructor = new Constructor(Settings.class);
+ final LoaderOptions options = new LoaderOptions();
+ final Constructor constructor = new Constructor(Settings.class, options);
final TypeDescription settingsDescription = new TypeDescription(Settings.class);
settingsDescription.addPropertyParameters("graphs", String.class, String.class);
settingsDescription.addPropertyParameters("scriptEngines", String.class, ScriptEngineSettings.class);
@@ -346,7 +348,7 @@ public class Settings {
constructor.addTypeDescription(settingsDescription);
final TypeDescription serializerSettingsDescription = new TypeDescription(SerializerSettings.class);
- serializerSettingsDescription.putMapPropertyType("config", String.class, Object.class);
+ serializerSettingsDescription.addPropertyParameters("config", String.class, Object.class);
constructor.addTypeDescription(serializerSettingsDescription);
final TypeDescription scriptEngineSettingsDescription = new TypeDescription(ScriptEngineSettings.class);
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/authz/AllowList.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/authz/AllowList.java
index 2d9d509437..cb295f86c7 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/authz/AllowList.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/authz/AllowList.java
@@ -18,6 +18,7 @@
*/
package org.apache.tinkerpop.gremlin.server.authz;
+import org.yaml.snakeyaml.LoaderOptions;
import org.yaml.snakeyaml.TypeDescription;
import org.yaml.snakeyaml.Yaml;
import org.yaml.snakeyaml.constructor.Constructor;
@@ -58,10 +59,11 @@ public class AllowList {
public static AllowList read(final String file) throws Exception {
final InputStream stream = new FileInputStream(new File(file));
- final Constructor constructor = new Constructor(AllowList.class);
+ final LoaderOptions options = new LoaderOptions();
+ final Constructor constructor = new Constructor(AllowList.class, options);
final TypeDescription allowListDescription = new TypeDescription(AllowList.class);
- allowListDescription.putMapPropertyType("grants", String.class, Object.class);
- allowListDescription.putMapPropertyType("groups", String.class, Object.class);
+ allowListDescription.addPropertyParameters("grants", String.class, Object.class);
+ allowListDescription.addPropertyParameters("groups", String.class, Object.class);
constructor.addTypeDescription(allowListDescription);
final Yaml yaml = new Yaml(constructor);
diff --git a/pom.xml b/pom.xml
index e5edddbc39..89bb8491d3 100644
--- a/pom.xml
+++ b/pom.xml
@@ -152,7 +152,7 @@ limitations under the License.
<antlr4.version>4.9.1</antlr4.version>
<caffeine.version>2.3.1</caffeine.version>
<commons.collections.version>3.2.2</commons.collections.version>
- <commons.configuration.version>2.8.0</commons.configuration.version>
+ <commons.configuration.version>2.9.0</commons.configuration.version>
<commons.lang.version>2.6</commons.lang.version>
<commons.io.version>2.8.0</commons.io.version>
<commons.lang3.version>3.11</commons.lang3.version>
@@ -173,7 +173,7 @@ limitations under the License.
<mockito.version>3.3.3</mockito.version>
<netty.version>4.1.86.Final</netty.version>
<slf4j.version>1.7.25</slf4j.version>
- <snakeyaml.version>1.32</snakeyaml.version>
+ <snakeyaml.version>2.0</snakeyaml.version>
<spark.version>3.0.0</spark.version>
<powermock.version>2.0.9</powermock.version>