This is an automated email from the ASF dual-hosted git repository. dongjoon pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/spark.git
The following commit(s) were added to refs/heads/master by this push: new edf4ac4b518d [SPARK-47056][TESTS] Add `scalastyle` and `checkstyle` rules to ban `FileBackedOutputStream` edf4ac4b518d is described below commit edf4ac4b518d0d69f7012ff5c0f1428fe45412ba Author: Dongjoon Hyun <dh...@apple.com> AuthorDate: Thu Feb 15 01:26:59 2024 -0800 [SPARK-47056][TESTS] Add `scalastyle` and `checkstyle` rules to ban `FileBackedOutputStream` ### What changes were proposed in this pull request? This PR aims to add `scalastyle` and `checkstyle` rules to ban `FileBackedOutputStream`. ### Why are the changes needed? We don't use this but this will explicitly prevent any accidental usage of `FileBackedOutputStream` in the future. ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass the CIs. ### Was this patch authored or co-authored using generative AI tooling? No. Closes #45116 from dongjoon-hyun/SPARK-47056. Authored-by: Dongjoon Hyun <dh...@apple.com> Signed-off-by: Dongjoon Hyun <dh...@apple.com> --- dev/checkstyle.xml | 4 ++++ scalastyle-config.xml | 5 +++++ 2 files changed, 9 insertions(+) diff --git a/dev/checkstyle.xml b/dev/checkstyle.xml index b9997d2050d1..cb7e962e8033 100644 --- a/dev/checkstyle.xml +++ b/dev/checkstyle.xml @@ -180,6 +180,10 @@ value="Avoid using com.google.common.io.Files.createTempDir() due to CVE-2020-8908. Use org.apache.spark.network.util.JavaUtils.createTempDir() instead." /> </module> + <module name="RegexpSinglelineJava"> + <property name="format" value="FileBackedOutputStream"/> + <property name="message" value="Avoid using FileBackedOutputStream due to CVE-2023-2976." /> + </module> <module name="RegexpSinglelineJava"> <property name="format" value="@Test\(expected"/> <property name="message" value="Please use the `assertThrows` method to test for exceptions." /> diff --git a/scalastyle-config.xml b/scalastyle-config.xml index 2077769c71d0..5a2cf7ed4f44 100644 --- a/scalastyle-config.xml +++ b/scalastyle-config.xml @@ -462,6 +462,11 @@ This file is divided into 3 sections: </customMessage> </check> + <check customId="GuavaFileBackedOutputStream" level="error" class="org.scalastyle.file.RegexChecker" enabled="true"> + <parameters><parameter name="regex">FileBackedOutputStream</parameter></parameters> + <customMessage>Avoid using FileBackedOutputStream due to CVE-2023-2976.</customMessage> + </check> + <check customId="pathfromuri" level="error" class="org.scalastyle.file.RegexChecker" enabled="true"> <parameters><parameter name="regex">new Path\(new URI\(</parameter></parameters> <customMessage><![CDATA[ --------------------------------------------------------------------- To unsubscribe, e-mail: commits-unsubscr...@spark.apache.org For additional commands, e-mail: commits-h...@spark.apache.org