Sandor Molnar created KNOX-3565:
-----------------------------------
Summary: Exclude snappy-java from hadoop-common dependency
Key: KNOX-3565
URL: https://issues.apache.org/jira/browse/KNOX-3565
Project: Apache Knox
Issue Type: Task
Components: Server
Affects Versions: 3.0.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.1.0
hadoop-common 3.4.1 transitively pulls in
org.xerial.snappy:snappy-java:1.1.10.4 at compile scope, and it reaches almost
every module through gateway-spi, gateway-server, gateway-spi-common and the
topology modules. Knox never uses Hadoop compression codecs (no
Snappy/CompressionCodec references in the codebase), so the jar is dead weight
and adds CVE exposure.
Proposed fix:
* Add a snappy-java <exclusion> to the hadoop-common entry in the root pom's
dependencyManagement, the same way it's already excluded from curator-test.
* Add the same exclusion to the hadoop-common test-jar declaration in
gateway-test-release, which dependencyManagement doesn't cover.
* Add a maven-enforcer-plugin bannedDependencies rule for
org.xerial.snappy:snappy-java so it can't come back through another dependency.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
