Skip to content

[security] Basic Audit#859

Merged
bohutang merged 4 commits into
databendlabs:masterfrom
PsiACE:audit
Jun 24, 2021
Merged

[security] Basic Audit#859
bohutang merged 4 commits into
databendlabs:masterfrom
PsiACE:audit

Conversation

@PsiACE

@PsiACE PsiACE commented Jun 20, 2021

Copy link
Copy Markdown
Contributor

I hereby agree to the terms of the CLA available at: https://datafuse.rs/policies/cla/

Summary

  • add pr-audit workflow (will fail now, but it works)
  • check dependency status (auto & quick, but not accurate enough)

Changelog

  • Build/Testing/CI

Related Issues

Related #852

Test Plan

No test plan.

PsiACE added 3 commits June 21, 2021 03:33
@PsiACE
[ci] add pr audit workflow
a905a59 
Signed-off-by: Chojan Shang <psiace@outlook.com>
@PsiACE
[README] add dependency status
e071f36 
Signed-off-by: Chojan Shang <psiace@outlook.com>
@PsiACE
[deps] bump ordered-float
42b9138 
Signed-off-by: Chojan Shang <psiace@outlook.com>
@databend-bot databend-bot added the pr-build this PR changes build/testing/ci steps label Jun 20, 2021
@databend-bot

databend-bot commented Jun 20, 2021

Copy link
Copy Markdown
Member

Thanks for the contribution!
I have applied any labels matching special text in your PR Changelog.

Please review the labels and make any necessary changes.

PsiACE
PsiACE commented Jun 20, 2021
View reviewed changes
Comment thread .github/workflows/pr-audit.yml
jobs:
security-audit:
runs-on: ubuntu-latest
if: "!contains(github.event.head_commit.message, 'audit skip')"

@PsiACE PsiACE Jun 20, 2021 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

change to if: "contains(github.event.head_commit.message, 'audit')"?

@PsiACE PsiACE Jun 20, 2021

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

or check github.event.comment.body when pr is created?

@codecov-commenter

codecov-commenter commented Jun 20, 2021 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

Merging #859 (f518f33) into master (8a30080) will increase coverage by 0%.
The diff coverage is 0%.

Impacted file tree graph

@@          Coverage Diff           @@
##           master    #859   +/-   ##
======================================
  Coverage      77%     77%           
======================================
  Files         326     326           
  Lines       18019   18111   +92     
======================================
+ Hits        14037   14122   +85     
- Misses       3982    3989    +7
Impacted Files Coverage Δ
common/datavalues/src/data_value_kernel.rs 41% <0%> (ø)
common/runtime/src/runtime_test.rs 46% <0%> (-47%) ⬇️
fusestore/store/src/meta_service/meta_test.rs 97% <0%> (-2%) ⬇️
fusestore/store/src/meta_service/raftmeta_test.rs 94% <0%> (-1%) ⬇️
fusequery/query/src/api/http_service.rs 0% <0%> (ø)
fusestore/store/src/api/rpc/flight_service.rs 57% <0%> (ø)
...e/store/src/meta_service/meta_service_impl_test.rs 88% <0%> (+<1%) ⬆️
fusestore/store/src/executor/action_handler.rs 70% <0%> (+<1%) ⬆️
fusestore/store/src/meta_service/raftmeta.rs 67% <0%> (+<1%) ⬆️
...usestore/store/src/executor/action_handler_test.rs 97% <0%> (+<1%) ⬆️
... and 4 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8a30080...f518f33. Read the comment docs.

@bohutang

bohutang commented Jun 21, 2021

Copy link
Copy Markdown
Member

Cool.
The only 1 vulnerability is

Crate:         flatbuffers
Version:       0.8.4
Title:         `read_scalar` and `read_scalar_at` allow transmuting values without `unsafe` blocks
Date:          2020-04-11
ID:            RUSTSEC-2020-0009
URL:           https://rustsec.org/advisories/RUSTSEC-2020-0009
Solution:      No safe upgrade is available!

Pain

bohutang
bohutang reviewed Jun 21, 2021
View reviewed changes
Comment thread common/datavalues/Cargo.toml
anyhow = "1.0.41"
paste = "^1.0"
ordered-float = "2.0"
ordered-float = "2.5"

@bohutang bohutang Jun 21, 2021

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, why we bump ordered-float here?

@bohutang bohutang Jun 21, 2021

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see.
This is scanned by https://deps.rs/repo/github/datafuselabs/datafuse
It seems that's the dep bot job, don't know why it's not working

bohutang
bohutang reviewed Jun 21, 2021
View reviewed changes
Comment thread README.md
<h1>Datafuse</h1>
<strong>
Modern Real-Time Data Processing & Analytics DBMS with Cloud-Native Architecture
Modern Real-Time Data Processing & Analytics DBMS with Cloud-Native Architecture

@bohutang bohutang Jun 21, 2021

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@bohutang

bohutang commented Jun 21, 2021

Copy link
Copy Markdown
Member

Cool.
The only 1 vulnerability is

Crate:         flatbuffers
Version:       0.8.4
Title:         `read_scalar` and `read_scalar_at` allow transmuting values without `unsafe` blocks
Date:          2020-04-11
ID:            RUSTSEC-2020-0009
URL:           https://rustsec.org/advisories/RUSTSEC-2020-0009
Solution:      No safe upgrade is available!

Pain

arrow-rs upstraem:
https://deps.rs/repo/github/apache/arrow-rs#vulnerabilities

We can fix it in: https://github.com/datafuse-extras/arrow-rs
And back port to the arrow-rs upstream.

@PsiACE

PsiACE commented Jun 23, 2021

Copy link
Copy Markdown
Contributor Author

arrow-rs upstraem:
https://deps.rs/repo/github/apache/arrow-rs#vulnerabilities

We can fix it in: https://github.com/datafuse-extras/arrow-rs
And back port to the arrow-rs upstream.

@bohutang

bohutang commented Jun 24, 2021

Copy link
Copy Markdown
Member

@PsiACE

We can use https://github.com/datafuse-extras/arrow-rs for this patch now 🚀

@PsiACE
[deps] use datafuse-extras/arrow-rs
f518f33 
Signed-off-by: Chojan Shang <psiace@outlook.com>
bohutang
bohutang approved these changes Jun 24, 2021
View reviewed changes

@bohutang bohutang left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Look great to me

@databend-bot

databend-bot commented Jun 24, 2021

Copy link
Copy Markdown
Member

CI Passed
Reviewer Approved
Let's Merge

8 similar comments
@databend-bot

databend-bot commented Jun 24, 2021

Copy link
Copy Markdown
Member

CI Passed
Reviewer Approved
Let's Merge

@databend-bot

databend-bot commented Jun 24, 2021

Copy link
Copy Markdown
Member

CI Passed
Reviewer Approved
Let's Merge

@databend-bot

databend-bot commented Jun 24, 2021

Copy link
Copy Markdown
Member

CI Passed
Reviewer Approved
Let's Merge

@databend-bot

databend-bot commented Jun 24, 2021

Copy link
Copy Markdown
Member

CI Passed
Reviewer Approved
Let's Merge

@databend-bot

databend-bot commented Jun 24, 2021

Copy link
Copy Markdown
Member

CI Passed
Reviewer Approved
Let's Merge

@databend-bot

databend-bot commented Jun 24, 2021

Copy link
Copy Markdown
Member

CI Passed
Reviewer Approved
Let's Merge

@databend-bot

databend-bot commented Jun 24, 2021

Copy link
Copy Markdown
Member

CI Passed
Reviewer Approved
Let's Merge

@databend-bot

databend-bot commented Jun 24, 2021

Copy link
Copy Markdown
Member

CI Passed
Reviewer Approved
Let's Merge

@bohutang
bohutang merged commit ad701f5 into databendlabs:master Jun 24, 2021
@PsiACE
PsiACE deleted the audit branch June 24, 2021 04:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bohutang bohutang bohutang approved these changes

Assignees

No one assigned

Labels

pr-build this PR changes build/testing/ci steps

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@PsiACE @databend-bot @codecov-commenter @bohutang