branch-4.0: [chore](deps) Upgrade vulnerable FE dependencies #65700 - #66124
Open
github-actions[bot] wants to merge 1 commit into
Open
branch-4.0: [chore](deps) Upgrade vulnerable FE dependencies #65700#66124github-actions[bot] wants to merge 1 commit into
github-actions[bot] wants to merge 1 commit into
Conversation
### What problem does this PR solve? Issue Number: None Related PR: None Problem Summary: This PR upgrades FE dependencies that are directly controlled by the Maven POMs and were reported with CVEs by dependency-check on the `rich/master` baseline. Upgraded because dependency-check reported CVEs: - `commons-configuration2` `2.11.0` -> `2.15.1` (CVE-2026-45205, MEDIUM) - `postgresql` `42.7.3` -> `42.7.13` (CVE-2026-42198, HIGH) Required companion upgrade (not a CVE fix): - `commons-text` `1.10.0` -> `1.15.0` `commons-configuration2:2.15.1` is compiled against `commons-text:1.15.0` and its `org.apache.commons.configuration2.interpol.StringLookupAdapter` calls `StringLookup.apply(String)`. That method only exists once `StringLookup` extends `UnaryOperator` (1.15.0); `commons-text:1.10.0` declares `lookup(String)` only. Leaving Text pinned at 1.10.0 would therefore make any interpolation path that goes through `StringLookupAdapter` (e.g. Hadoop `MetricsConfig` resolving `${sys:user.home}`) fail with `NoSuchMethodError` at runtime. 1.15.0 still contains the Text4Shell (CVE-2022-42889) fix that 1.10.0 was originally pinned for, so this is not a CVE regression. Notable upstream behavior change (documented, no Doris code change): - `commons-configuration2:2.15.1` adds a URL-scheme allow-list to file/URL location loading. `AbstractFileLocationStrategy` now defaults `DEFAULT_SCHEMES` to `file,jar` and rejects any other scheme with `ConfigurationDeniedException` (complete overridable set: `file,http,https,jar`). This is an upstream security hardening (mitigates loading configuration from arbitrary remote URLs). A configuration that pulls a remote include over `http`/`https` -- e.g. a Hadoop `hadoop-metrics2*.properties` with `include = https://...` -- will now fail to load by default. Doris does not ship such a configuration, so there is no expected impact; a deployment that genuinely relied on remote includes can restore the old behavior with the system property `-Dorg.apache.commons.configuration2.io.FileLocationStrategy.schemes=file,http,https,jar`. We deliberately do not re-open `http`/`https` by default, as that would undo the upstream fix. Deliberately NOT changed: - `dev.cel` stays at `0.12.0`. An earlier revision of this PR bumped it to `0.13.1`, but dependency-check reports **zero** vulnerabilities for `cel-0.12.0.jar` (no suppressions), and there is no published CVE/GHSA for `dev.cel` / `cel-java`. The bump carried real risk for no security benefit: `0.13.1` ships a new `dev.cel.runtime.planner` evaluation engine and can broaden the accepted CEL dialect, which matters because `RoleMappingMgr` validates a mapping only on the creating FE and journals the source expression, while replay stores it without compiling and `DefinitionBackedRoleMappingEvaluator` recompiles it lazily at authentication time. During a mixed-version rollout that could turn into an authentication failure on a not-yet-upgraded FE. Reverting the bump removes that exposure entirely. - Azure SDK components are left at the versions managed by `azure-sdk-bom` `1.3.7`. An earlier revision overrode `azure-core`/`azure-core-http-netty`/`azure-identity` to newer patch levels, but BOM `1.3.7` already manages `azure-core 1.58.0`, `azure-identity 1.18.3` and `azure-security-keyvault-keys 4.10.7` -- all at or above their fixed versions -- and no FE module declares `azure-security-keyvault-keys` (the artifact CVE-2026-33117 affects). The overrides therefore remediated no shipped vulnerable coordinate and only added BOM skew, so they were dropped. The refreshed dependency-check JSON no longer contains the old direct vulnerable coordinates `commons-configuration2@2.11.0` or `postgresql@42.7.3`. Some remaining findings are still reported for shaded/bundled dependencies or CPE matches that are not safely removable through a small POM-only change. ### Release note None ### Check List (For Author) - Test: - `env DORIS_THIRDPARTY=/mnt/disk1/gq/idea/thirdparty mvn -pl fe-core -am install -DskipTests -Dskip.doc=true -Dmaven.build.cache.enabled=false` - `mvn org.owasp:dependency-check-maven:12.2.0:aggregate -Dformat=ALL -DfailBuildOnCVSS=11 -DfailOnError=false -DnvdApiServerId=nvd-api-key -DnvdValidForHours=2160 -Dmaven.build.cache.enabled=false -DyarnAuditAnalyzerEnabled=false -DretireJsAnalyzerEnabled=false -DassemblyAnalyzerEnabled=false -DnugetconfAnalyzerEnabled=false -DnuspecAnalyzerEnabled=false -DskipTests` - Behavior changed: Only an upstream commons-configuration2 URL-scheme allow-list (documented above); no Doris-side behavior change and no default configuration ships a remote include. - Does this need documentation: No
Contributor
|
Thank you for your contribution to Apache Doris. Please clearly describe your PR:
|
Contributor
|
run buildall |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-picked from #65700