This is an automated email from the ASF dual-hosted git repository.
dongjoon pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/spark.git
The following commit(s) were added to refs/heads/master by this push:
new edf4ac4b518d [SPARK-47056][TESTS] Add `scalastyle` and `checkstyle`
rules to ban `FileBackedOutputStream`
edf4ac4b518d is described below
commit edf4ac4b518d0d69f7012ff5c0f1428fe45412ba
Author: Dongjoon Hyun <dh...@apple.com>
AuthorDate: Thu Feb 15 01:26:59 2024 -0800
[SPARK-47056][TESTS] Add `scalastyle` and `checkstyle` rules to ban
`FileBackedOutputStream`
### What changes were proposed in this pull request?
This PR aims to add `scalastyle` and `checkstyle` rules to ban
`FileBackedOutputStream`.
### Why are the changes needed?
We don't use this but this will explicitly prevent any accidental usage of
`FileBackedOutputStream` in the future.
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
Pass the CIs.
### Was this patch authored or co-authored using generative AI tooling?
No.
Closes #45116 from dongjoon-hyun/SPARK-47056.
Authored-by: Dongjoon Hyun <dh...@apple.com>
Signed-off-by: Dongjoon Hyun <dh...@apple.com>
---
dev/checkstyle.xml | 4 ++++
scalastyle-config.xml | 5 +++++
2 files changed, 9 insertions(+)
diff --git a/dev/checkstyle.xml b/dev/checkstyle.xml
index b9997d2050d1..cb7e962e8033 100644
--- a/dev/checkstyle.xml
+++ b/dev/checkstyle.xml
@@ -180,6 +180,10 @@
value="Avoid using com.google.common.io.Files.createTempDir()
due to CVE-2020-8908.
Use org.apache.spark.network.util.JavaUtils.createTempDir()
instead." />
</module>
+ <module name="RegexpSinglelineJava">
+ <property name="format" value="FileBackedOutputStream"/>
+ <property name="message" value="Avoid using FileBackedOutputStream
due to CVE-2023-2976." />
+ </module>
<module name="RegexpSinglelineJava">
<property name="format" value="@Test\(expected"/>
<property name="message" value="Please use the `assertThrows`
method to test for exceptions." />
diff --git a/scalastyle-config.xml b/scalastyle-config.xml
index 2077769c71d0..5a2cf7ed4f44 100644
--- a/scalastyle-config.xml
+++ b/scalastyle-config.xml
@@ -462,6 +462,11 @@ This file is divided into 3 sections:
</customMessage>
</check>
+ <check customId="GuavaFileBackedOutputStream" level="error"
class="org.scalastyle.file.RegexChecker" enabled="true">
+ <parameters><parameter
name="regex">FileBackedOutputStream</parameter></parameters>
+ <customMessage>Avoid using FileBackedOutputStream due to
CVE-2023-2976.</customMessage>
+ </check>
+
<check customId="pathfromuri" level="error"
class="org.scalastyle.file.RegexChecker" enabled="true">
<parameters><parameter name="regex">new Path\(new
URI\(</parameter></parameters>
<customMessage><