Skip to content

unpin snakeyaml, add suppressions and licenses #15549

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xvrl merged 4 commits into from
Dec 15, 2023
Merged

unpin snakeyaml, add suppressions and licenses #15549

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3249af4
unpin snakeyaml, add suppressions and licenses
janjwerner-confluent Dec 13, 2023
2543ef8
pin snakeyaml in the specific modules that require version 1.x, updat…
janjwerner-confluent Dec 13, 2023
540d502
add reasoning for the individual snakeyaml pins
janjwerner-confluent Dec 13, 2023
319b2b6
add both versions of snakeyaml to suppression file
janjwerner-confluent Dec 14, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions extensions-contrib/cassandra-storage/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,21 @@
<relativePath>../../pom.xml</relativePath>
</parent>

<dependencyManagement>
<dependencies>
<!-- snakeyaml explicitly pinned to version 1.33 as it is
a transitive dependency of:
com.netflix.astyanax:astyanax:jar -> g.apache.cassandra:cassandra-all:jar
please remove this pin after the update of astyanax, see comment below
-->
<dependency>
<groupId>org.yaml</groupId>
<artifactId>snakeyaml</artifactId>
<version>1.33</version>
</dependency>
</dependencies>
</dependencyManagement>

<dependencies>
<dependency>
<groupId>org.apache.druid</groupId>
Expand Down
12 changes: 12 additions & 0 deletions extensions-contrib/kubernetes-overlord-extensions/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,18 @@
<relativePath>../../pom.xml</relativePath>
</parent>

<dependencyManagement>
Comment thread
xvrl marked this conversation as resolved.
<dependencies>
<!-- snakeyaml explicitly pinned to version 1.33 as it is
a transitive dependency of com.fasterxml.jackson.dataformat:jackson-dataformat-yaml 2.12.7
please remove this pin, after updating jackson-dataform-yaml to version > 2.14.3 / 2.15.0 -->
<dependency>
<groupId>org.yaml</groupId>
<artifactId>snakeyaml</artifactId>
<version>1.33</version>
</dependency>
</dependencies>
</dependencyManagement>

<dependencies>
<dependency>
Expand Down
13 changes: 13 additions & 0 deletions integration-tests/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,19 @@
<hadoop.s3.impl>org.apache.hadoop.fs.s3a.S3AFileSystem</hadoop.s3.impl>
</properties>

<dependencyManagement>
Comment thread
xvrl marked this conversation as resolved.
<dependencies>
<!-- snakeyaml explicitly pinned to version 1.33 as it is
a transitive dependency of com.fasterxml.jackson.dataformat:jackson-dataformat-yaml 2.12.7
please remove this pin, after updating jackson-dataform-yaml to version > 2.14.3 / 2.15.0 -->
<dependency>
<groupId>org.yaml</groupId>
<artifactId>snakeyaml</artifactId>
<version>1.33</version>
</dependency>
</dependencies>
</dependencyManagement>

<dependencies>
<dependency>
<groupId>com.amazonaws</groupId>
Expand Down
14 changes: 13 additions & 1 deletion licenses.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1022,7 +1022,7 @@ name: org.yaml snakeyaml
license_category: binary
module: extensions/druid-kubernetes-extensions
license_name: Apache License version 2.0
version: 1.33
version: 2.2
libraries:
- org.yaml: snakeyaml

Expand Down Expand Up @@ -2872,6 +2872,18 @@ libraries:
- io.confluent: kafka-schema-registry-client
- io.confluent: common-utils

---

name: org.yaml snakeyaml
license_category: binary
module: extensions/druid-protobuf-extensions
license_name: Apache License version 2.0
version: 2.0
libraries:
- org.yaml: snakeyaml



---

name: Confluent Kafka Client
Expand Down
19 changes: 15 additions & 4 deletions owasp-dependency-check-suppressions.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -275,12 +275,23 @@
</suppress>

<suppress>
<!-- We need to wait for 17.0.0 of https://github.com/kubernetes-client/java/releases -->
<!-- We need to update several other components to move to Snakeyaml 2.0 to address CVE-2022-1471 -->
<!-- Snakeyaml 1.33 added to dependencyManagement in main pom file -->
<!-- The main use of snakeyaml in Druid is coming in test scope from:
com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:jar:2.12.7
(version 1.27)
The contrib extension: druid-cassandra-storage uses version 1.6 in compile
scope
The integration tests use version 1.27 in compile scope.
Copy link
Copy Markdown
Member

@xvrl xvrl Dec 13, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we know where 1.27 comes from in integration tests? It would be nice if we could upgrade integration tests to 2.x as well.

Copy link
Copy Markdown
Contributor Author

@janjwerner-confluent janjwerner-confluent Dec 13, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it's transitive dependency of:
com.fasterxml.jackson.dataformat:jackson-dataformat-yaml 2.12.7
so unless we update jackson there, can't upgrade.

Copy link
Copy Markdown
Member

@xvrl xvrl Dec 13, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's update the version since we pin integration tests to 1.33 and not 1.27

Copy link
Copy Markdown
Member

@xvrl xvrl Dec 15, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if this is more hairy, we can do the jackson upgrade as a follow-up

Previous pinning of version to 1.33 forced the usage of the version across
all the modules, downgrading the version for some of them.
The removal of the pin in the main POM allows the modules choose which version
to be used, enabling the users to disable contrib extensions and use the
CVE free version of Snakeyaml in core extensions.
-->

<notes><![CDATA[
file name: snakeyaml-1.33.jar
file name: snakeyaml-1.27.jar snakeyaml-1.33.jar
Copy link
Copy Markdown
Member

@xvrl xvrl Dec 15, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we shouldn't be regressing here and have everything at least on 1.33 like we did before.

Copy link
Copy Markdown

@janjwerner janjwerner Dec 15, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is just for completeness as snakeyaml is not packaged in the standard distribution
mvn clean install -Pdist -DskipTests
dependency-check-maven is disabled for the contrib extensions and it tests, this suppression stays in place if we re-enable checks on the additional modules)

Copy link
Copy Markdown

@janjwerner janjwerner Dec 15, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please see:
#15447
#15026

]]></notes>
<!-- Snakeyaml is used only in test scope in Druid core with trusted inputs -->
<cve>CVE-2022-1471</cve>
<!-- false positive -->
<cve>CVE-2023-2251</cve>
Expand Down
5 changes: 0 additions & 5 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -364,11 +364,6 @@
<artifactId>json-smart</artifactId>
<version>2.4.11</version>
</dependency>
<dependency>
<groupId>org.yaml</groupId>
<artifactId>snakeyaml</artifactId>
<version>1.33</version>
</dependency>

<!-- transitive dependency of testng
this would be resolved by updating
Expand Down