[
https://issues.apache.org/jira/browse/KNOX-3565?focusedWorklogId=1054095&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1054095
]
ASF GitHub Bot logged work on KNOX-3565:
----------------------------------------
Author: ASF GitHub Bot
Created on: 11/Nov/26 16:10
Start Date: 11/Nov/26 16:10
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request, #1507:
URL: https://github.com/apache/knox/pull/1507
[KNOX-3565](https://issues.apache.org/jira/browse/KNOX-3565) - Exclude
snappy-java from hadoop-common
## What changes were proposed in this pull request?
hadoop-common 3.4.1 transitively pulled
`org.xerial.snappy:snappy-java:1.1.10.4` into almost every module at compile
scope. Knox doesn't use Hadoop compression codecs, so this PR removes it:
- Excludes snappy-java from the managed `hadoop-common` dependency in the
root pom.
- Excludes it from the `hadoop-common` test-jar in `gateway-test-release`,
which dependencyManagement doesn't cover.
- Adds `org.xerial.snappy:snappy-java` to the enforcer's
`bannedDependencies` so it can't come back through another dependency.
## How was this patch tested?
- `mvn dependency:tree -Dincludes=org.xerial.snappy:snappy-java` finds
nothing in any module.
- `mvn validate` passes with the new enforcer ban.
- Unit tests pass for `gateway-spi`, `gateway-topology-hadoop-xml`,
`gateway-provider-identity-assertion-hadoop-groups` and
`gateway-provider-security-hadoopauth`.
## Integration Tests
No integration tests were added or changed; this is a dependency-only
change. The existing CI suites cover the runtime behavior.
Issue Time Tracking
-------------------
Worklog Id: (was: 1054095)
Remaining Estimate: 0h
Time Spent: 10m
> Exclude snappy-java from hadoop-common dependency
> -------------------------------------------------
>
> Key: KNOX-3565
> URL: https://issues.apache.org/jira/browse/KNOX-3565
> Project: Apache Knox
> Issue Type: Task
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> hadoop-common 3.4.1 transitively pulls in
> org.xerial.snappy:snappy-java:1.1.10.4 at compile scope, and it reaches
> almost every module through gateway-spi, gateway-server, gateway-spi-common
> and the topology modules. Knox never uses Hadoop compression codecs (no
> Snappy/CompressionCodec references in the codebase), so the jar is dead
> weight and adds CVE exposure.
> Proposed fix:
> * Add a snappy-java <exclusion> to the hadoop-common entry in the root pom's
> dependencyManagement, the same way it's already excluded from curator-test.
> * Add the same exclusion to the hadoop-common test-jar declaration in
> gateway-test-release, which dependencyManagement doesn't cover.
> * Add a maven-enforcer-plugin bannedDependencies rule for
> org.xerial.snappy:snappy-java so it can't come back through another
> dependency.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
