From 85a518b64d564897c6717917143415d81eebf881 Mon Sep 17 00:00:00 2001
From: "tejaswini.bandlamudi" <tejaswini.bandlamudi@imply.io>
Date: Fri, 16 Jun 2023 12:26:37 +0530
Subject: [PATCH 1/4] update avro version to 1.11.1 and remove CVE supperssions

---
 owasp-dependency-check-suppressions.xml | 8 --------
 pom.xml                                 | 2 +-
 2 files changed, 1 insertion(+), 9 deletions(-)

diff --git a/owasp-dependency-check-suppressions.xml b/owasp-dependency-check-suppressions.xml
index 3095ed160c63..e4c2ddf73c04 100644
--- a/owasp-dependency-check-suppressions.xml
+++ b/owasp-dependency-check-suppressions.xml
@@ -472,14 +472,6 @@
     <cve>CVE-2020-13949</cve>
   </suppress>
 
-  <suppress>
-    <!-- (avro, parquet, integration-tests) we don't allow velocity templates to be uploaded by untrusted users -->
-    <notes><![CDATA[
-     file name: velocity-engine-core-2.2.jar:
-     ]]></notes>
-    <cve>CVE-2020-13936</cve>
-  </suppress>
-
   <suppress>
      <!-- (ranger, ambari, and aliyun-oss) these vulnerabilities are legit, but their latest releases still use the vulnerable jackson version -->
      <notes><![CDATA[
diff --git a/pom.xml b/pom.xml
index 7e50bac3a588..cbc2f476661f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -81,7 +81,7 @@
         <apache.ranger.gson.version>2.2.4</apache.ranger.gson.version>
         <scala.library.version>2.13.9</scala.library.version>
         <avatica.version>1.17.0</avatica.version>
-        <avro.version>1.9.2</avro.version>
+        <avro.version>1.11.1</avro.version>
         <!-- sql/src/main/codegen/config.fmpp is based on a file from calcite-core, and needs to be
           updated when upgrading Calcite. Refer to the top-level comments in that file for details.
           Also, CalcitePlanner is a clone of Calcite's PlannerImpl and may require updates when

From b721707063c92b717dc6f2aa2f922bd4cd3aee9e Mon Sep 17 00:00:00 2001
From: "tejaswini.bandlamudi" <tejaswini.bandlamudi@imply.io>
Date: Fri, 16 Jun 2023 13:04:06 +0530
Subject: [PATCH 2/4] update licenses.yaml

---
 licenses.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/licenses.yaml b/licenses.yaml
index a16bdc80e9f6..e4acf36062e2 100644
--- a/licenses.yaml
+++ b/licenses.yaml
@@ -3634,7 +3634,7 @@ libraries:
 ---
 
 name: Apache Velocity Engine
-version: 2.2
+version: 2.3
 license_category: binary
 module: extensions/druid-avro-extensions
 license_name: Apache License version 2.0
@@ -3652,7 +3652,7 @@ name: Apache Avro
 license_category: binary
 module: extensions/druid-avro-extensions
 license_name: Apache License version 2.0
-version: 1.9.2
+version: 1.11.1
 libraries:
   - org.apache.avro: avro
   - org.apache.avro: avro-mapred

From 13a283b161b692a9318b503f8171c0fc669627b6 Mon Sep 17 00:00:00 2001
From: "tejaswini.bandlamudi" <tejaswini.bandlamudi@imply.io>
Date: Mon, 19 Jun 2023 12:45:03 +0530
Subject: [PATCH 3/4] Return null in case field not found in schema

---
 .../apache/druid/data/input/avro/AvroFlattenerMaker.java   | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/extensions-core/avro-extensions/src/main/java/org/apache/druid/data/input/avro/AvroFlattenerMaker.java b/extensions-core/avro-extensions/src/main/java/org/apache/druid/data/input/avro/AvroFlattenerMaker.java
index d557b65c8474..f100c62c2017 100644
--- a/extensions-core/avro-extensions/src/main/java/org/apache/druid/data/input/avro/AvroFlattenerMaker.java
+++ b/extensions-core/avro-extensions/src/main/java/org/apache/druid/data/input/avro/AvroFlattenerMaker.java
@@ -24,6 +24,7 @@
 import com.jayway.jsonpath.JsonPath;
 import com.jayway.jsonpath.Option;
 import com.jayway.jsonpath.spi.json.JsonProvider;
+import org.apache.avro.AvroRuntimeException;
 import org.apache.avro.Schema;
 import org.apache.avro.generic.GenericArray;
 import org.apache.avro.generic.GenericEnumSymbol;
@@ -141,7 +142,11 @@ public Set<String> discoverRootFields(final GenericRecord obj)
   @Override
   public Object getRootField(final GenericRecord record, final String key)
   {
-    return transformValue(record.get(key));
+    try {
+      return transformValue(record.get(key));
+    } catch (AvroRuntimeException e) {
+      return null;
+    }
   }
 
   @Override

From 6090f302804727a16f43fdf64fca18cbce1f67de Mon Sep 17 00:00:00 2001
From: "tejaswini.bandlamudi" <tejaswini.bandlamudi@imply.io>
Date: Wed, 21 Jun 2023 12:58:07 +0530
Subject: [PATCH 4/4] refactoring logic

---
 .../org/apache/druid/data/input/avro/AvroFlattenerMaker.java | 5 ++---
 .../apache/druid/data/input/avro/AvroFlattenerMakerTest.java | 4 ++++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/extensions-core/avro-extensions/src/main/java/org/apache/druid/data/input/avro/AvroFlattenerMaker.java b/extensions-core/avro-extensions/src/main/java/org/apache/druid/data/input/avro/AvroFlattenerMaker.java
index f100c62c2017..007608159f43 100644
--- a/extensions-core/avro-extensions/src/main/java/org/apache/druid/data/input/avro/AvroFlattenerMaker.java
+++ b/extensions-core/avro-extensions/src/main/java/org/apache/druid/data/input/avro/AvroFlattenerMaker.java
@@ -24,7 +24,6 @@
 import com.jayway.jsonpath.JsonPath;
 import com.jayway.jsonpath.Option;
 import com.jayway.jsonpath.spi.json.JsonProvider;
-import org.apache.avro.AvroRuntimeException;
 import org.apache.avro.Schema;
 import org.apache.avro.generic.GenericArray;
 import org.apache.avro.generic.GenericEnumSymbol;
@@ -142,9 +141,9 @@ public Set<String> discoverRootFields(final GenericRecord obj)
   @Override
   public Object getRootField(final GenericRecord record, final String key)
   {
-    try {
+    if (record.getSchema().getField(key) != null) {
       return transformValue(record.get(key));
-    } catch (AvroRuntimeException e) {
+    } else {
       return null;
     }
   }
diff --git a/extensions-core/avro-extensions/src/test/java/org/apache/druid/data/input/avro/AvroFlattenerMakerTest.java b/extensions-core/avro-extensions/src/test/java/org/apache/druid/data/input/avro/AvroFlattenerMakerTest.java
index 59e15deeb74c..18197b88e4c6 100644
--- a/extensions-core/avro-extensions/src/test/java/org/apache/druid/data/input/avro/AvroFlattenerMakerTest.java
+++ b/extensions-core/avro-extensions/src/test/java/org/apache/druid/data/input/avro/AvroFlattenerMakerTest.java
@@ -349,6 +349,10 @@ private void getRootField_common(final SomeAvroDatum record, final AvroFlattener
         list,
         flattener.getRootField(record, "someRecordArray")
     );
+    Assert.assertEquals(
+        null,
+        flattener.getRootField(record, "invalidField")
+    );
   }
 
   private void makeJsonPathExtractor_common(final SomeAvroDatum record, final AvroFlattenerMaker flattener)