From c10d7313f8213ce6701559663f7d996f5b04944e Mon Sep 17 00:00:00 2001 From: Josef Cacek Date: Thu, 4 Mar 2021 09:18:25 +0100 Subject: [PATCH 1/2] Update netty version to fix CVE-2021-21290 Upgrade the netty version to remediate the [CVE-2021-21290](https://nvd.nist.gov/vuln/detail/CVE-2021-21290) vulnerability. --- build.gradle | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build.gradle b/build.gradle index 5c605dcab37..e7452234aef 100644 --- a/build.gradle +++ b/build.gradle @@ -54,7 +54,7 @@ subprojects { protocPluginBaseName = 'protoc-gen-grpc-java' javaPluginPath = "$rootDir/compiler/build/exe/java_plugin/$protocPluginBaseName$exeSuffix" - nettyVersion = '4.1.52.Final' + nettyVersion = '4.1.59.Final' guavaVersion = '30.0-android' googleauthVersion = '0.22.2' protobufVersion = '3.12.0' From e70c0ecaa05de4792e46475ec2c68c05906e1aeb Mon Sep 17 00:00:00 2001 From: Josef Cacek Date: Thu, 4 Mar 2021 11:20:26 +0100 Subject: [PATCH 2/2] Fix OkHttpTransportTest after the Netty upgrade --- .../test/java/io/grpc/internal/AbstractTransportTest.java | 3 ++- .../src/test/java/io/grpc/okhttp/OkHttpTransportTest.java | 6 ------ 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/core/src/test/java/io/grpc/internal/AbstractTransportTest.java b/core/src/test/java/io/grpc/internal/AbstractTransportTest.java index e19db3e9638..7a3c9be3ccd 100644 --- a/core/src/test/java/io/grpc/internal/AbstractTransportTest.java +++ b/core/src/test/java/io/grpc/internal/AbstractTransportTest.java @@ -1920,7 +1920,8 @@ public void serverChecksInboundMetadataSize() throws Exception { // If this times out, the server probably isn't noticing the metadata size Status status = clientStreamListener.status.get(TIMEOUT_MS, TimeUnit.MILLISECONDS); List codeOptions = Arrays.asList( - Status.Code.UNKNOWN, Status.Code.RESOURCE_EXHAUSTED, Status.Code.INTERNAL); + Status.Code.UNKNOWN, Status.Code.RESOURCE_EXHAUSTED, Status.Code.INTERNAL, + Status.Code.UNAVAILABLE); if (!codeOptions.contains(status.getCode())) { fail("Status code was not expected: " + status); } diff --git a/okhttp/src/test/java/io/grpc/okhttp/OkHttpTransportTest.java b/okhttp/src/test/java/io/grpc/okhttp/OkHttpTransportTest.java index 44e493c259f..9f415d41aef 100644 --- a/okhttp/src/test/java/io/grpc/okhttp/OkHttpTransportTest.java +++ b/okhttp/src/test/java/io/grpc/okhttp/OkHttpTransportTest.java @@ -101,10 +101,4 @@ protected boolean haveTransportTracer() { return true; } - @Override - @org.junit.Test - @org.junit.Ignore - public void clientChecksInboundMetadataSize_trailer() { - // Server-side is flaky due to https://github.com/netty/netty/pull/8332 - } }