HBASE-22863 : Cleanup transitive Jackson1 vulnerable dependencies(forward-port HBASE-22728) #505
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
🎊 +1 overall
This message was automatically generated. |
virajjasani
changed the title
|
🎊 +1 overall
This message was automatically generated. |
|
🎊 +1 overall
This message was automatically generated. |
Apache9
requested changes
Aug 18, 2019
hbase-zookeeper/pom.xml
Outdated
| @@ -274,6 +284,16 @@ | |||
| <dependency> | |||
| <groupId>org.apache.hadoop</groupId> | |||
| <artifactId>hadoop-common</artifactId> | |||
| <exclusions> | |||
There was a problem hiding this comment.
Can we add these exclusions in the parent pom? No?
There was a problem hiding this comment.
Unfortunately, that doesn't work
There was a problem hiding this comment.
Oh you mean just exclude from parent pom and we don't need to exclude from individual modules right? Sure let me do that for jackson-jaxrs and jackson-xc since they are common across all modules
There was a problem hiding this comment.
Yes, that's what I mean, excluding in the parent pom so the sub modules just inherit the exclusions automatically. But I'm not a maven expert so please confirm whether it actually works...
There was a problem hiding this comment.
@Apache9 this doesn't work as expected. For instance, if downstream app has hbase-client dependency and if we have just excluded from parent pom, downstream would still get vulnerable Jackson1 dependencies from hbase-client. In fact, the same is done for branch-1: 4b34d24 (removal in individual modules so that downstreamer won't pull in from HBase)
There was a problem hiding this comment.
OK for now but this is a bit strange. At least the downstreamer need to find the version from parent pom, then why it just ignores the exclusions?
There was a problem hiding this comment.
And what I mean is to exclude them in the dependencyManagement section in the parent pom, not in dependency section(and I wonder whether we have this section in the parent pom...)
Could you please try again?
There was a problem hiding this comment.
You are correct @Apache9
It works...Thanks. Just committed the changes
There was a problem hiding this comment.
I have committed all the necessary and suggested changes.
@Apache9 Since we have moved to Jackson2, we can safely exclude these dependencies. At some places, we require jackson-mapper-asl:1.9.13(CVE exposed) at test scope to run tests like HBaseTestUtility.startMiniCluster(). But definitely not required at compile scope as we would expose these to downstreamers otherwise. This is partly forwardport from HBASE-22728 to master and branch-2. |
|
So we need to add the jackson dependency explicitly as a test dependency in our own pom as we exclude them from the hadoop-common? |
Correct. Just did it here: https://github.com/apache/hbase/pull/505/files#diff-659d55cb388d174df96d2c372cfc982fR138 |
|
So what about our own UTs? How do we include the jackson1 dependencies for hbase-server test module for example? |
|
That is already included from hadoop-minicluster only, but at test scop: |
|
Let me provide the full dependency tree for Jackson1 with this patch: @Apache9 Please let me know how this looks. |
|
🎊 +1 overall
This message was automatically generated. |
virajjasani
force-pushed
the
HBASE-22863-master
branch
from
1e8f7d0
to
3251c54
Compare
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
🎊 +1 overall
This message was automatically generated. |
|
Thanks for the review @Apache9 @Reidddddd For branch-2, I have attached patch(HBASE-22863.branch-2.000.patch) on the JIRA. With that patch, dependency tree for branch-2 comes exactly similar to what I updated on this PR for master. |
|
💔 -1 overall
This message was automatically generated. |
|
@Apache9 @Reidddddd |
|
💔 -1 overall
This message was automatically generated. |
asfgit
pushed a commit
that referenced
this pull request
Aug 21, 2019
…rd-port HBASE-22728) (#505) Signed-off-by: Duo Zhang <zhangduo@apache.org> Signed-off-by: Reid Chan <reidchan@apache.org>
asfgit
pushed a commit
that referenced
this pull request
Aug 21, 2019
…rd-port HBASE-22728) (#505) Signed-off-by: Duo Zhang <zhangduo@apache.org> Signed-off-by: Reid Chan <reidchan@apache.org>
asfgit
pushed a commit
that referenced
this pull request
Aug 21, 2019
…rd-port HBASE-22728) (#505) Signed-off-by: Duo Zhang <zhangduo@apache.org> Signed-off-by: Reid Chan <reidchan@apache.org>
|
💔 -1 overall
This message was automatically generated. |
infraio
pushed a commit
to infraio/hbase
that referenced
this pull request
Aug 17, 2020
…rd-port HBASE-22728) (apache#505) Signed-off-by: Duo Zhang <zhangduo@apache.org> Signed-off-by: Reid Chan <reidchan@apache.org>
symat
pushed a commit
to symat/hbase
that referenced
this pull request
Feb 17, 2021
…rd-port HBASE-22728) (apache#505) Signed-off-by: Duo Zhang <zhangduo@apache.org> Signed-off-by: Reid Chan <reidchan@apache.org> (cherry picked from commit 84d092c) Change-Id: Ib0da7f02001acead63190b80c27413cb2e6a93c5
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Partly forwardport from HBASE-22728 to master and branch-2