Akanksha-kedia commented on PR #6760:
URL: https://github.com/apache/hive/pull/6760#issuecomment-5596323534
Found and fixed the Jenkins failure (`AvroBytesConverterTest`), but flagging
a bigger implication for review.
**Root cause**: Avro's 1.12.x line added
`org.apache.avro.util.ClassSecurityValidator`, which closes an
unrestricted-deserialization CVE class by refusing to resolve *any* class as a
`SpecificRecord` unless explicitly trusted via
`org.apache.avro.SERIALIZABLE_CLASSES`/`SERIALIZABLE_PACKAGES`. 1.12.0 didn't
enforce this; 1.12.2 does by default. `AvroBytesConverterTest` hit this because
`KafkaAvroSerializer.serialize()` (Confluent) internally builds a
`SpecificDatumWriter`, which calls `SpecificData.getClass()` to resolve the
test's `SimpleRecord` fixture class — and that's now forbidden by default.
**Test fix pushed**: trust the test's own fixture class via
`System.setProperty("org.apache.avro.SERIALIZABLE_CLASSES",
SimpleRecord.class.getName())` in `@BeforeClass`, scoped to this test only.
**Bigger concern**: `KafkaSerDe.AvroBytesConverter.getWritable()` (the
production deserialization path, not just this test) also constructs a
`SpecificDatumReader`, which goes through the *identical*
`SpecificData.getClass()` check. That means any real user querying Kafka Avro
data via a schema that resolves to a generated `SpecificRecord` class (the
standard pattern with Confluent Schema Registry + code-generated Avro classes)
will hit the same `SecurityException` in production after this bump — not just
in this test.
I deliberately did **not** try to work around that in production code, since
picking a trust boundary there (e.g. blanket-trusting a package) is a real
design/security decision that risks reintroducing the exact class of
vulnerability this Avro change closes, and affects real users' arbitrary class
names — not something to decide unilaterally in a version-bump PR. Wanted to
surface it explicitly so a maintainer can weigh in on whether this needs a
migration note, a Hive-side default-trust mechanism, or should hold until
that's resolved.
@ayushtkn @uros-b flagging for your take given the security angle.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
