Skip to content

Commit

Permalink
#343: added audit framework. Removed security risks (#344)
Browse files Browse the repository at this point in the history
  • Loading branch information
@AnastasiiaSergienko
AnastasiiaSergienko committed Jun 23, 2020
1 parent 0102d8f commit c7dad61
Show file tree
Hide file tree
Showing 2 changed files with 107 additions and 3 deletions.
7 changes: 5 additions & 2 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,7 @@ Running the Virtual Schema requires a Java Runtime version 9 or later.
| Dependency | Purpose | License |
|-------------------------------------------------------------------------------------|--------------------------------------------------------|----------------------------------|
| [Apache Maven](https://maven.apache.org/) | Build tool | Apache License 2.0 |
| [Apache Trift][apache-trift] | Need for Hive integration test | Apache License 2.0 |
| [Exasol JDBC Driver][exasol-jdbc-driver] | JDBC driver for Exasol database | MIT License |
| [Exasol Testcontainers][exasol-testcontainers] | Exasol extension for the Testcontainers framework | MIT License |
| [HBase server][hbase-server] | The Hadoop database | Apache License 2.0 |
Expand All @@ -137,12 +138,14 @@ Running the Virtual Schema requires a Java Runtime version 9 or later.
| [Maven Jacoco Plugin](https://www.eclemma.org/jacoco/trunk/doc/maven.html) | Code coverage metering | Eclipse Public License 2.0 |
| [Maven Source Plugin](https://maven.apache.org/plugins/maven-source-plugin/) | Creating a source code JAR | Apache License 2.0 |
| [Maven Surefire Plugin](https://maven.apache.org/surefire/maven-surefire-plugin/) | Unit testing | Apache License 2.0 |
| [Sonatype OSS Index Maven Plugin][sonatype-oss-index-maven-plugin] | Checking Dependencies Vulnerability | ASL2 |


[apache-trift]: http://thrift.apache.org/
[exasol-jdbc-driver]: https://www.exasol.com/portal/display/DOWNLOAD/Exasol+Download+Section
[exasol-testcontainers]: https://github.com/exasol/exasol-testcontainers
[hbase-server]: http://hbase.apache.org/
[hive-jdbc-driver]: https://github.com/apache/hive/tree/master/jdbc/src/java/org/apache/hive/jdbc
[exasol-testcontainers]: https://github.com/exasol/exasol-testcontainers
[mysql-jdbc-driver]: https://dev.mysql.com/downloads/connector/j/
[oracle-jdbc-driver]: https://www.oracle.com/database/technologies/appdev/jdbc.html
[postgresql-jdbc-driver]: https://jdbc.postgresql.org/
[sonatype-oss-index-maven-plugin]: https://sonatype.github.io/ossindex-maven/maven-plugin/
103 changes: 102 additions & 1 deletion pom.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -148,12 +148,99 @@
<artifactId>hive-jdbc</artifactId>
<version>3.1.2</version>
<scope>test</scope>
<!--Excluding transient dependencies with vulnerabilities-->
<exclusions>
<exclusion>
<groupId>org.eclipse.jetty</groupId>
<artifactId>*</artifactId>
</exclusion>
<exclusion>
<groupId>io.netty</groupId>
<artifactId>*</artifactId>
</exclusion>
<exclusion>
<groupId>org.codehaus.jackson</groupId>
<artifactId>jackson-mapper-asl</artifactId>
</exclusion>
<exclusion>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
</exclusion>
<exclusion>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.hadoop</groupId>
<artifactId>hadoop-yarn-server-resourcemanager</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.derby</groupId>
<artifactId>*</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.zookeeper</groupId>
<artifactId>zookeeper</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.thrift</groupId>
<artifactId>libfb303</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.thrift</groupId>
<artifactId>libthrift</artifactId>
</exclusion>
</exclusions>
</dependency>
<!-- Excluded the older version of this dependency from hive JDBC driver
and added a new one here with fixed security issues. This dependency can be removed
when hive JDBC driver updates its dependencies list.-->
<dependency>
<groupId>org.apache.thrift</groupId>
<artifactId>libthrift</artifactId>
<version>0.13.0</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.apache.hbase</groupId>
<artifactId>hbase-server</artifactId>
<version>2.2.4</version>
<version>2.2.5</version>
<scope>test</scope>
<!--Excluding transient dependencies with vulnerabilities-->
<exclusions>
<exclusion>
<groupId>org.eclipse.jetty</groupId>
<artifactId>*</artifactId>
</exclusion>
<exclusion>
<groupId>io.netty</groupId>
<artifactId>*</artifactId>
</exclusion>
<exclusion>
<groupId>org.codehaus.jackson</groupId>
<artifactId>jackson-mapper-asl</artifactId>
</exclusion>
<exclusion>
<groupId>com.google.protobuf</groupId>
<artifactId>protobuf-java</artifactId>
</exclusion>
<exclusion>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
</exclusion>
<exclusion>
<groupId>com.squareup.okhttp</groupId>
<artifactId>okhttp</artifactId>
</exclusion>
<exclusion>
<groupId>org.mortbay.jetty</groupId>
<artifactId>*</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.zookeeper</groupId>
<artifactId>zookeeper</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.testcontainers</groupId>
Expand Down Expand Up @@ -276,6 +363,20 @@
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.sonatype.ossindex.maven</groupId>
<artifactId>ossindex-maven-plugin</artifactId>
<version>3.1.0</version>
<executions>
<execution>
<id>audit-dependencies</id>
<phase>package</phase>
<goals>
<goal>audit</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build>
</project>

0 comments on commit c7dad61

Please sign in to comment.