[
https://issues.apache.org/jira/browse/KNOX-3565?focusedWorklogId=1054122&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1054122
]
ASF GitHub Bot logged work on KNOX-3565:
----------------------------------------
Author: ASF GitHub Bot
Created on: 11/Nov/26 18:16
Start Date: 11/Nov/26 18:16
Worklog Time Spent: 10m
Work Description: github-actions[bot] commented on PR #1507:
URL: https://github.com/apache/knox/pull/1507#issuecomment-6803740548
## Test Results
5 files 5 suites 1m 41s ⏱️
212 tests 210 ✅ 2 💤 0 ❌
253 runs 251 ✅ 2 💤 0 ❌
Results for commit 4e0e17b9.
[test-results]:data:application/gzip;base64,H4sIAPKw9GoC/02Myw7CIBQFf6Vh7YJnEX/GAL0kxLYYHivjv0tJhS5nzsl8kPMrJPSYxG1CqfjcYSlRZx/2igSTKuqUj5ES+qdnKtY2hYd6+fehunDar1WMB8QY4mli2VtTsBN6UpBuRrHxJdj42rNh23yugDhgINIoTbWeZwbKgANileVc0zuWTHG6GCrR9wft18eyBQEAAA==
Issue Time Tracking
-------------------
Worklog Id: (was: 1054122)
Time Spent: 20m (was: 10m)
> Exclude snappy-java from hadoop-common dependency
> -------------------------------------------------
>
> Key: KNOX-3565
> URL: https://issues.apache.org/jira/browse/KNOX-3565
> Project: Apache Knox
> Issue Type: Task
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> hadoop-common 3.4.1 transitively pulls in
> org.xerial.snappy:snappy-java:1.1.10.4 at compile scope, and it reaches
> almost every module through gateway-spi, gateway-server, gateway-spi-common
> and the topology modules. Knox never uses Hadoop compression codecs (no
> Snappy/CompressionCodec references in the codebase), so the jar is dead
> weight and adds CVE exposure.
> Proposed fix:
> * Add a snappy-java <exclusion> to the hadoop-common entry in the root pom's
> dependencyManagement, the same way it's already excluded from curator-test.
> * Add the same exclusion to the hadoop-common test-jar declaration in
> gateway-test-release, which dependencyManagement doesn't cover.
> * Add a maven-enforcer-plugin bannedDependencies rule for
> org.xerial.snappy:snappy-java so it can't come back through another
> dependency.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
