[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15388776#comment-15388776 ] Hadoop QA commented on HBASE-16267: --- | (x) *{color:red}-1 overall{color}* | \\ \\ || Vote || Subsystem || Runtime || Comment || | {color:blue}0{color} | {color:blue} patch {color} | {color:blue} 0m 3s {color} | {color:blue} The patch file was not named according to hbase's naming conventions. Please see https://yetus.apache.org/documentation/0.2.1/precommit-patchnames for instructions. {color} | | {color:green}+1{color} | {color:green} hbaseanti {color} | {color:green} 0m 0s {color} | {color:green} Patch does not have any anti-patterns. {color} | | {color:green}+1{color} | {color:green} @author {color} | {color:green} 0m 0s {color} | {color:green} The patch does not contain any @author tags. {color} | | {color:green}+1{color} | {color:green} test4tests {color} | {color:green} 0m 0s {color} | {color:green} The patch appears to include 6 new or modified test files. {color} | | {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue} 9m 23s {color} | {color:blue} Maven dependency ordering for branch {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 16m 1s {color} | {color:green} master passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 29s {color} | {color:green} master passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 28s {color} | {color:green} master passed with JDK v1.7.0_80 {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 1m 1s {color} | {color:green} master passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 3m 18s {color} | {color:green} master passed {color} | | {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue} 0m 0s {color} | {color:blue} Skipped branch modules with no Java source: . {color} | | {color:red}-1{color} | {color:red} findbugs {color} | {color:red} 0m 39s {color} | {color:red} hbase-rest in master has 1 extant Findbugs warnings. {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 3m 5s {color} | {color:green} master passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 2m 47s {color} | {color:green} master passed with JDK v1.7.0_80 {color} | | {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue} 0m 9s {color} | {color:blue} Maven dependency ordering for patch {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 4m 8s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 26s {color} | {color:green} the patch passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 3m 26s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 31s {color} | {color:green} the patch passed with JDK v1.7.0_80 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 3m 31s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 0m 29s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 2m 26s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} whitespace {color} | {color:green} 0m 0s {color} | {color:green} Patch has no whitespace issues. {color} | | {color:green}+1{color} | {color:green} xml {color} | {color:green} 0m 1s {color} | {color:green} The patch has no ill-formed XML file. {color} | | {color:green}+1{color} | {color:green} hadoopcheck {color} | {color:green} 31m 51s {color} | {color:green} Patch does not cause any errors with Hadoop 2.4.0 2.4.1 2.5.0 2.5.1 2.5.2 2.6.1 2.6.2 2.6.3 2.7.1. {color} | | {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue} 0m 0s {color} | {color:blue} Skipped patch modules with no Java source: . {color} | | {color:red}-1{color} | {color:red} findbugs {color} | {color:red} 1m 15s {color} | {color:red} hbase-rest generated 3 new + 1 unchanged - 0 fixed = 4 total (was 1) {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 3m 52s {color} | {color:green} the patch passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 2m 31s {color} | {color:green} the patch passed with JDK v1.7.0_80 {color} | | {color:red}-1{color} | {color:red} unit {color} | {color:red} 3m 48s {color} | {color:red} hbase-rest in the patch failed. {color} | | {color:red}-1{color} | {color:red} unit {color} | {colo
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15388998#comment-15388998 ] Hadoop QA commented on HBASE-16267: --- | (x) *{color:red}-1 overall{color}* | \\ \\ || Vote || Subsystem || Runtime || Comment || | {color:blue}0{color} | {color:blue} patch {color} | {color:blue} 0m 1s {color} | {color:blue} The patch file was not named according to hbase's naming conventions. Please see https://yetus.apache.org/documentation/0.2.1/precommit-patchnames for instructions. {color} | | {color:green}+1{color} | {color:green} hbaseanti {color} | {color:green} 0m 0s {color} | {color:green} Patch does not have any anti-patterns. {color} | | {color:green}+1{color} | {color:green} @author {color} | {color:green} 0m 0s {color} | {color:green} The patch does not contain any @author tags. {color} | | {color:green}+1{color} | {color:green} test4tests {color} | {color:green} 0m 0s {color} | {color:green} The patch appears to include 6 new or modified test files. {color} | | {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue} 1m 33s {color} | {color:blue} Maven dependency ordering for branch {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 3m 18s {color} | {color:green} master passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 28s {color} | {color:green} master passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 19s {color} | {color:green} master passed with JDK v1.7.0_80 {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 2m 38s {color} | {color:green} master passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 1m 34s {color} | {color:green} master passed {color} | | {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue} 0m 0s {color} | {color:blue} Skipped branch modules with no Java source: . {color} | | {color:red}-1{color} | {color:red} findbugs {color} | {color:red} 0m 36s {color} | {color:red} hbase-rest in master has 1 extant Findbugs warnings. {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 3m 15s {color} | {color:green} master passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 3m 6s {color} | {color:green} master passed with JDK v1.7.0_80 {color} | | {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue} 0m 8s {color} | {color:blue} Maven dependency ordering for patch {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 3m 57s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 29s {color} | {color:green} the patch passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 3m 29s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 16s {color} | {color:green} the patch passed with JDK v1.7.0_80 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 3m 16s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 2m 40s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 1m 30s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} whitespace {color} | {color:green} 0m 0s {color} | {color:green} Patch has no whitespace issues. {color} | | {color:green}+1{color} | {color:green} xml {color} | {color:green} 0m 1s {color} | {color:green} The patch has no ill-formed XML file. {color} | | {color:green}+1{color} | {color:green} hadoopcheck {color} | {color:green} 26m 30s {color} | {color:green} Patch does not cause any errors with Hadoop 2.4.0 2.4.1 2.5.0 2.5.1 2.5.2 2.6.1 2.6.2 2.6.3 2.7.1. {color} | | {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue} 0m 0s {color} | {color:blue} Skipped patch modules with no Java source: . {color} | | {color:red}-1{color} | {color:red} findbugs {color} | {color:red} 0m 50s {color} | {color:red} hbase-rest generated 1 new + 1 unchanged - 0 fixed = 2 total (was 1) {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 3m 17s {color} | {color:green} the patch passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 3m 21s {color} | {color:green} the patch passed with JDK v1.7.0_80 {color} | | {color:red}-1{color} | {color:red} unit {color} | {color:red} 17m 1s {color} | {color:red} hbase-server in the patch failed. {color} | | {color:red}-1{color} | {color:red} unit {color} | {
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15389526#comment-15389526 ] Hadoop QA commented on HBASE-16267: --- | (x) *{color:red}-1 overall{color}* | \\ \\ || Vote || Subsystem || Runtime || Comment || | {color:blue}0{color} | {color:blue} patch {color} | {color:blue} 0m 2s {color} | {color:blue} The patch file was not named according to hbase's naming conventions. Please see https://yetus.apache.org/documentation/0.2.1/precommit-patchnames for instructions. {color} | | {color:green}+1{color} | {color:green} hbaseanti {color} | {color:green} 0m 0s {color} | {color:green} Patch does not have any anti-patterns. {color} | | {color:green}+1{color} | {color:green} @author {color} | {color:green} 0m 0s {color} | {color:green} The patch does not contain any @author tags. {color} | | {color:green}+1{color} | {color:green} test4tests {color} | {color:green} 0m 0s {color} | {color:green} The patch appears to include 6 new or modified test files. {color} | | {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue} 0m 47s {color} | {color:blue} Maven dependency ordering for branch {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 3m 5s {color} | {color:green} master passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 29s {color} | {color:green} master passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 17s {color} | {color:green} master passed with JDK v1.7.0_80 {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 2m 40s {color} | {color:green} master passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 1m 34s {color} | {color:green} master passed {color} | | {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue} 0m 0s {color} | {color:blue} Skipped branch modules with no Java source: . {color} | | {color:red}-1{color} | {color:red} findbugs {color} | {color:red} 0m 35s {color} | {color:red} hbase-rest in master has 1 extant Findbugs warnings. {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 3m 8s {color} | {color:green} master passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 3m 7s {color} | {color:green} master passed with JDK v1.7.0_80 {color} | | {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue} 0m 9s {color} | {color:blue} Maven dependency ordering for patch {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 3m 55s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 27s {color} | {color:green} the patch passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 3m 27s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 18s {color} | {color:green} the patch passed with JDK v1.7.0_80 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 3m 18s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 2m 41s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 1m 35s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} whitespace {color} | {color:green} 0m 0s {color} | {color:green} Patch has no whitespace issues. {color} | | {color:green}+1{color} | {color:green} xml {color} | {color:green} 0m 2s {color} | {color:green} The patch has no ill-formed XML file. {color} | | {color:green}+1{color} | {color:green} hadoopcheck {color} | {color:green} 26m 43s {color} | {color:green} Patch does not cause any errors with Hadoop 2.4.0 2.4.1 2.5.0 2.5.1 2.5.2 2.6.1 2.6.2 2.6.3 2.7.1. {color} | | {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue} 0m 0s {color} | {color:blue} Skipped patch modules with no Java source: . {color} | | {color:red}-1{color} | {color:red} findbugs {color} | {color:red} 0m 49s {color} | {color:red} hbase-rest generated 1 new + 1 unchanged - 0 fixed = 2 total (was 1) {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 3m 11s {color} | {color:green} the patch passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 3m 4s {color} | {color:green} the patch passed with JDK v1.7.0_80 {color} | | {color:red}-1{color} | {color:red} unit {color} | {color:red} 17m 25s {color} | {color:red} hbase-server in the patch failed. {color} | | {color:green}+1{color} | {color:green} unit {color} |
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15389952#comment-15389952 ] Josh Elser commented on HBASE-16267: Looks pretty good, [~tedyu]. Some quick comments. Nit, commented code: {code} @@ -269,11 +291,11 @@ public class Client { */ public Response head(Cluster cluster, String path, Header[] headers) throws IOException { -HeadMethod method = new HeadMethod(); +HttpHead method = new HttpHead(path); try { - int code = execute(cluster, method, null, path); - headers = method.getResponseHeaders(); - return new Response(code, headers, null); + HttpResponse resp = execute(cluster, method, null, path); + // headers = method.getResponseHeaders(); + return new Response(resp.getStatusLine().getStatusCode(), resp.getAllHeaders(), null); } finally { method.releaseConnection(); } {code} Document that this is not thread safe? {code} @@ -69,13 +73,14 @@ public class Response { * Constructor * @param code the HTTP response code * @param headers headers the HTTP response headers - * @param body the response body, can be null + * @param resp the response * @param in Inputstream if the response had one. */ - public Response(int code, Header[] headers, byte[] body, InputStream in) { + public Response(int code, Header[] headers, HttpResponse resp, InputStream in) { this.code = code; this.headers = headers; -this.body = body; +this.body = null; +this.resp = resp; this.stream = in; } @@ -129,6 +134,13 @@ public class Response { * @return the HTTP response body */ public byte[] getBody() { +if (body == null) { + try { +body = Client.getResponseBody(resp); + } catch (IOException ioe) { +Log.debug("encountered ioe when obtaining body", ioe); + } +} return body; } {code} Isn't this exclusion already covered by the exclusions you added to dependencyManagement in the root-level pom.xml in the hadoop-3.0 profile? {code} @@ -388,6 +392,12 @@ org.apache.hadoop hadoop-common + + + commons-httpclient + commons-httpclient + + org.apache.hadoop {code} > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v2.txt, > 16267.v4.txt, 16267.v6.txt, 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15390004#comment-15390004 ] Hadoop QA commented on HBASE-16267: --- | (x) *{color:red}-1 overall{color}* | \\ \\ || Vote || Subsystem || Runtime || Comment || | {color:blue}0{color} | {color:blue} patch {color} | {color:blue} 0m 1s {color} | {color:blue} The patch file was not named according to hbase's naming conventions. Please see https://yetus.apache.org/documentation/0.2.1/precommit-patchnames for instructions. {color} | | {color:green}+1{color} | {color:green} hbaseanti {color} | {color:green} 0m 0s {color} | {color:green} Patch does not have any anti-patterns. {color} | | {color:green}+1{color} | {color:green} @author {color} | {color:green} 0m 0s {color} | {color:green} The patch does not contain any @author tags. {color} | | {color:green}+1{color} | {color:green} test4tests {color} | {color:green} 0m 0s {color} | {color:green} The patch appears to include 6 new or modified test files. {color} | | {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue} 0m 14s {color} | {color:blue} Maven dependency ordering for branch {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 4m 28s {color} | {color:green} master passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 5m 20s {color} | {color:green} master passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 4m 58s {color} | {color:green} master passed with JDK v1.7.0_80 {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 0m 49s {color} | {color:green} master passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 2m 0s {color} | {color:green} master passed {color} | | {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue} 0m 0s {color} | {color:blue} Skipped branch modules with no Java source: . {color} | | {color:red}-1{color} | {color:red} findbugs {color} | {color:red} 1m 0s {color} | {color:red} hbase-rest in master has 1 extant Findbugs warnings. {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 5m 22s {color} | {color:green} master passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 4m 19s {color} | {color:green} master passed with JDK v1.7.0_80 {color} | | {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue} 0m 13s {color} | {color:blue} Maven dependency ordering for patch {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 5m 16s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 5m 42s {color} | {color:green} the patch passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 5m 42s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 4m 28s {color} | {color:green} the patch passed with JDK v1.7.0_80 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 4m 28s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 0m 41s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 2m 2s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} whitespace {color} | {color:green} 0m 0s {color} | {color:green} Patch has no whitespace issues. {color} | | {color:green}+1{color} | {color:green} xml {color} | {color:green} 0m 1s {color} | {color:green} The patch has no ill-formed XML file. {color} | | {color:green}+1{color} | {color:green} hadoopcheck {color} | {color:green} 44m 38s {color} | {color:green} Patch does not cause any errors with Hadoop 2.4.0 2.4.1 2.5.0 2.5.1 2.5.2 2.6.1 2.6.2 2.6.3 2.7.1. {color} | | {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue} 0m 0s {color} | {color:blue} Skipped patch modules with no Java source: . {color} | | {color:red}-1{color} | {color:red} findbugs {color} | {color:red} 1m 16s {color} | {color:red} hbase-rest generated 1 new + 1 unchanged - 0 fixed = 2 total (was 1) {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 5m 8s {color} | {color:green} the patch passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 4m 21s {color} | {color:green} the patch passed with JDK v1.7.0_80 {color} | | {color:green}+1{color} | {color:green} unit {color} | {color:green} 6m 31s {color} | {color:green} hbase-rest in the patch passed. {color} | | {color:red}-1{color} | {color:red} unit {color}
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15390087#comment-15390087 ] Hadoop QA commented on HBASE-16267: --- | (x) *{color:red}-1 overall{color}* | \\ \\ || Vote || Subsystem || Runtime || Comment || | {color:blue}0{color} | {color:blue} patch {color} | {color:blue} 0m 2s {color} | {color:blue} The patch file was not named according to hbase's naming conventions. Please see https://yetus.apache.org/documentation/0.2.1/precommit-patchnames for instructions. {color} | | {color:green}+1{color} | {color:green} hbaseanti {color} | {color:green} 0m 0s {color} | {color:green} Patch does not have any anti-patterns. {color} | | {color:green}+1{color} | {color:green} @author {color} | {color:green} 0m 0s {color} | {color:green} The patch does not contain any @author tags. {color} | | {color:green}+1{color} | {color:green} test4tests {color} | {color:green} 0m 0s {color} | {color:green} The patch appears to include 6 new or modified test files. {color} | | {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue} 0m 12s {color} | {color:blue} Maven dependency ordering for branch {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 3m 24s {color} | {color:green} master passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 2m 57s {color} | {color:green} master passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 2m 47s {color} | {color:green} master passed with JDK v1.7.0_80 {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 0m 28s {color} | {color:green} master passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 1m 18s {color} | {color:green} master passed {color} | | {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue} 0m 0s {color} | {color:blue} Skipped branch modules with no Java source: . {color} | | {color:red}-1{color} | {color:red} findbugs {color} | {color:red} 0m 37s {color} | {color:red} hbase-rest in master has 1 extant Findbugs warnings. {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 2m 53s {color} | {color:green} master passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 2m 36s {color} | {color:green} master passed with JDK v1.7.0_80 {color} | | {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue} 0m 9s {color} | {color:blue} Maven dependency ordering for patch {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 3m 12s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 2m 54s {color} | {color:green} the patch passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 2m 54s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 2m 47s {color} | {color:green} the patch passed with JDK v1.7.0_80 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 2m 47s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 0m 29s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 1m 16s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} whitespace {color} | {color:green} 0m 0s {color} | {color:green} Patch has no whitespace issues. {color} | | {color:green}+1{color} | {color:green} xml {color} | {color:green} 0m 1s {color} | {color:green} The patch has no ill-formed XML file. {color} | | {color:green}+1{color} | {color:green} hadoopcheck {color} | {color:green} 27m 27s {color} | {color:green} Patch does not cause any errors with Hadoop 2.4.0 2.4.1 2.5.0 2.5.1 2.5.2 2.6.1 2.6.2 2.6.3 2.7.1. {color} | | {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue} 0m 0s {color} | {color:blue} Skipped patch modules with no Java source: . {color} | | {color:green}+1{color} | {color:green} findbugs {color} | {color:green} 0m 47s {color} | {color:green} hbase-rest generated 0 new + 0 unchanged - 1 fixed = 0 total (was 1) {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 2m 49s {color} | {color:green} the patch passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 2m 36s {color} | {color:green} the patch passed with JDK v1.7.0_80 {color} | | {color:green}+1{color} | {color:green} unit {color} | {color:green} 3m 46s {color} | {color:green} hbase-rest in the patch passed. {color} | | {color:red}-1{color} | {color:red} u
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15390290#comment-15390290 ] Hadoop QA commented on HBASE-16267: --- | (x) *{color:red}-1 overall{color}* | \\ \\ || Vote || Subsystem || Runtime || Comment || | {color:blue}0{color} | {color:blue} patch {color} | {color:blue} 0m 2s {color} | {color:blue} The patch file was not named according to hbase's naming conventions. Please see https://yetus.apache.org/documentation/0.2.1/precommit-patchnames for instructions. {color} | | {color:green}+1{color} | {color:green} hbaseanti {color} | {color:green} 0m 0s {color} | {color:green} Patch does not have any anti-patterns. {color} | | {color:green}+1{color} | {color:green} @author {color} | {color:green} 0m 0s {color} | {color:green} The patch does not contain any @author tags. {color} | | {color:green}+1{color} | {color:green} test4tests {color} | {color:green} 0m 0s {color} | {color:green} The patch appears to include 6 new or modified test files. {color} | | {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue} 2m 1s {color} | {color:blue} Maven dependency ordering for branch {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 3m 14s {color} | {color:green} master passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 7s {color} | {color:green} master passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 2m 43s {color} | {color:green} master passed with JDK v1.7.0_80 {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 0m 29s {color} | {color:green} master passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 1m 27s {color} | {color:green} master passed {color} | | {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue} 0m 0s {color} | {color:blue} Skipped branch modules with no Java source: . {color} | | {color:red}-1{color} | {color:red} findbugs {color} | {color:red} 0m 38s {color} | {color:red} hbase-rest in master has 1 extant Findbugs warnings. {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 3m 1s {color} | {color:green} master passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 2m 38s {color} | {color:green} master passed with JDK v1.7.0_80 {color} | | {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue} 0m 9s {color} | {color:blue} Maven dependency ordering for patch {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 3m 16s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 2m 54s {color} | {color:green} the patch passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 2m 54s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 2m 44s {color} | {color:green} the patch passed with JDK v1.7.0_80 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 2m 44s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 0m 28s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 1m 19s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} whitespace {color} | {color:green} 0m 0s {color} | {color:green} Patch has no whitespace issues. {color} | | {color:green}+1{color} | {color:green} xml {color} | {color:green} 0m 1s {color} | {color:green} The patch has no ill-formed XML file. {color} | | {color:green}+1{color} | {color:green} hadoopcheck {color} | {color:green} 26m 46s {color} | {color:green} Patch does not cause any errors with Hadoop 2.4.0 2.4.1 2.5.0 2.5.1 2.5.2 2.6.1 2.6.2 2.6.3 2.7.1. {color} | | {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue} 0m 0s {color} | {color:blue} Skipped patch modules with no Java source: . {color} | | {color:green}+1{color} | {color:green} findbugs {color} | {color:green} 0m 47s {color} | {color:green} hbase-rest generated 0 new + 0 unchanged - 1 fixed = 0 total (was 1) {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 2m 53s {color} | {color:green} the patch passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 2m 35s {color} | {color:green} the patch passed with JDK v1.7.0_80 {color} | | {color:green}+1{color} | {color:green} unit {color} | {color:green} 4m 11s {color} | {color:green} hbase-rest in the patch passed. {color} | | {color:red}-1{color} | {color:red} unit
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15390293#comment-15390293 ] Ted Yu commented on HBASE-16267: The failed tests are not in hbase-rest module. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15402423#comment-15402423 ] Josh Elser commented on HBASE-16267: On v12, you still have some commented out code, [~tedyu]. In {{hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/client/Client.java}} in the {{private void initialize(Cluster cluster, boolean sslEnabled)}} method. Looks fine to me otherwise. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15403033#comment-15403033 ] Hadoop QA commented on HBASE-16267: --- | (x) *{color:red}-1 overall{color}* | \\ \\ || Vote || Subsystem || Runtime || Comment || | {color:blue}0{color} | {color:blue} patch {color} | {color:blue} 0m 2s {color} | {color:blue} The patch file was not named according to hbase's naming conventions. Please see https://yetus.apache.org/documentation/0.2.1/precommit-patchnames for instructions. {color} | | {color:green}+1{color} | {color:green} hbaseanti {color} | {color:green} 0m 0s {color} | {color:green} Patch does not have any anti-patterns. {color} | | {color:green}+1{color} | {color:green} @author {color} | {color:green} 0m 0s {color} | {color:green} The patch does not contain any @author tags. {color} | | {color:green}+1{color} | {color:green} test4tests {color} | {color:green} 0m 0s {color} | {color:green} The patch appears to include 6 new or modified test files. {color} | | {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue} 0m 11s {color} | {color:blue} Maven dependency ordering for branch {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 3m 51s {color} | {color:green} master passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 40s {color} | {color:green} master passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 36s {color} | {color:green} master passed with JDK v1.7.0_80 {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 0m 29s {color} | {color:green} master passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 2m 33s {color} | {color:green} master passed {color} | | {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue} 0m 0s {color} | {color:blue} Skipped branch modules with no Java source: . {color} | | {color:red}-1{color} | {color:red} findbugs {color} | {color:red} 0m 43s {color} | {color:red} hbase-rest in master has 1 extant Findbugs warnings. {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 2m 55s {color} | {color:green} master passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 2m 49s {color} | {color:green} master passed with JDK v1.7.0_80 {color} | | {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue} 0m 10s {color} | {color:blue} Maven dependency ordering for patch {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 4m 10s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 43s {color} | {color:green} the patch passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 3m 43s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 42s {color} | {color:green} the patch passed with JDK v1.7.0_80 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 3m 42s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 0m 30s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 2m 37s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} whitespace {color} | {color:green} 0m 0s {color} | {color:green} Patch has no whitespace issues. {color} | | {color:green}+1{color} | {color:green} xml {color} | {color:green} 0m 0s {color} | {color:green} The patch has no ill-formed XML file. {color} | | {color:green}+1{color} | {color:green} hadoopcheck {color} | {color:green} 34m 11s {color} | {color:green} Patch does not cause any errors with Hadoop 2.4.0 2.4.1 2.5.0 2.5.1 2.5.2 2.6.1 2.6.2 2.6.3 2.7.1. {color} | | {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue} 0m 0s {color} | {color:blue} Skipped patch modules with no Java source: . {color} | | {color:green}+1{color} | {color:green} findbugs {color} | {color:green} 0m 55s {color} | {color:green} hbase-rest generated 0 new + 0 unchanged - 1 fixed = 0 total (was 1) {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 2m 56s {color} | {color:green} the patch passed with JDK v1.8.0 {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 2m 52s {color} | {color:green} the patch passed with JDK v1.7.0_80 {color} | | {color:red}-1{color} | {color:red} unit {color} | {color:red} 16m 40s {color} | {color:red} hbase-rest in the patch failed. {color} | | {color:red}-1{color} | {color:red} unit {c
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15404256#comment-15404256 ] Ted Yu commented on HBASE-16267: Test failure was due to: TestVersionResource.setUpBeforeClass:60 ยป OutOfMemory unable to create new nat... Planning to commit shortly. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, 16267.v8.txt, > 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15410645#comment-15410645 ] stack commented on HBASE-16267: --- Oh, this issue also needs a release note. It does more than the subject says; e.g. upgrading our httpclient globally by a couple of minor versions. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, 16267.v8.txt, > 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15410652#comment-15410652 ] Ted Yu commented on HBASE-16267: I spent some time (upgrading hadoop dependency to 2.7.3 RC) but TestLogLevel was still failing. We can revert this for the moment to unblock QA runs. After reverting this, commons-httpclient dependency still exposes security vulnerability. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, 16267.v8.txt, > 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15410654#comment-15410654 ] Ted Yu commented on HBASE-16267: Reverted from master. Pending appropriate hadoop release before putting back. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, 16267.v8.txt, > 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15410664#comment-15410664 ] stack commented on HBASE-16267: --- What is this issue trying to fix? > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, 16267.v8.txt, > 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15410668#comment-15410668 ] Ted Yu commented on HBASE-16267: The commons-httpclient dependency brought in by hbase-rest module exposes security vulnerability. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, 16267.v8.txt, > 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15410700#comment-15410700 ] Hudson commented on HBASE-16267: FAILURE: Integrated in HBase-Trunk_matrix #1366 (See [https://builds.apache.org/job/HBase-Trunk_matrix/1366/]) HBASE-16267 Revert due to failure of TestLogLevel (tedyu: rev 4e08a8bec9ef807134392ed05d7f0fd6eb0b1f38) * hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/client/Client.java * hbase-rest/pom.xml * hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestScannerResource.java * hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/MultiRowResource.java * hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/client/Response.java * hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestGzipFilter.java * hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestSchemaResource.java * hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestMultiRowResource.java * pom.xml * hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestGetAndPutResource.java * hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/client/TestRemoteTable.java > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, 16267.v8.txt, > 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15410729#comment-15410729 ] stack commented on HBASE-16267: --- Ok. It doesn't say that in subject. Sounds important to fix. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, 16267.v8.txt, > 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15412618#comment-15412618 ] Hadoop QA commented on HBASE-16267: --- | (x) *{color:red}-1 overall{color}* | \\ \\ || Vote || Subsystem || Runtime || Comment || | {color:blue}0{color} | {color:blue} reexec {color} | {color:blue} 67m 6s {color} | {color:blue} Docker mode activated. {color} | | {color:blue}0{color} | {color:blue} patch {color} | {color:blue} 0m 1s {color} | {color:blue} The patch file was not named according to hbase's naming conventions. Please see https://yetus.apache.org/documentation/0.3.0/precommit-patchnames for instructions. {color} | | {color:green}+1{color} | {color:green} @author {color} | {color:green} 0m 0s {color} | {color:green} The patch does not contain any @author tags. {color} | | {color:green}+1{color} | {color:green} test4tests {color} | {color:green} 0m 0s {color} | {color:green} The patch appears to include 6 new or modified test files. {color} | | {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue} 3m 44s {color} | {color:blue} Maven dependency ordering for branch {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 8m 25s {color} | {color:green} master passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 2m 40s {color} | {color:green} master passed with JDK v1.8.0_101 {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 4s {color} | {color:green} master passed with JDK v1.7.0_101 {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 0m 54s {color} | {color:green} master passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 2m 8s {color} | {color:green} master passed {color} | | {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue} 0m 0s {color} | {color:blue} Skipped patched modules with no Java source: . {color} | | {color:red}-1{color} | {color:red} findbugs {color} | {color:red} 0m 36s {color} | {color:red} hbase-rest in master has 1 extant Findbugs warnings. {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 2m 13s {color} | {color:green} master passed with JDK v1.8.0_101 {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 2m 52s {color} | {color:green} master passed with JDK v1.7.0_101 {color} | | {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue} 0m 11s {color} | {color:blue} Maven dependency ordering for patch {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 3m 52s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 2m 47s {color} | {color:green} the patch passed with JDK v1.8.0_101 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 2m 47s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 9s {color} | {color:green} the patch passed with JDK v1.7.0_101 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 3m 9s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 0m 30s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 1m 32s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} whitespace {color} | {color:green} 0m 0s {color} | {color:green} The patch has no whitespace issues. {color} | | {color:green}+1{color} | {color:green} xml {color} | {color:green} 0m 1s {color} | {color:green} The patch has no ill-formed XML file. {color} | | {color:green}+1{color} | {color:green} hadoopcheck {color} | {color:green} 31m 57s {color} | {color:green} Patch does not cause any errors with Hadoop 2.4.0 2.4.1 2.5.0 2.5.1 2.5.2 2.6.1 2.6.2 2.6.3 2.7.1. {color} | | {color:red}-1{color} | {color:red} hbaseprotoc {color} | {color:red} 0m 12s {color} | {color:red} root in the patch failed. {color} | | {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue} 0m 0s {color} | {color:blue} Skipped patched modules with no Java source: . {color} | | {color:green}+1{color} | {color:green} findbugs {color} | {color:green} 0m 48s {color} | {color:green} hbase-rest generated 0 new + 0 unchanged - 1 fixed = 0 total (was 1) {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 2m 0s {color} | {color:green} the patch passed with JDK v1.8.0_101 {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 2m 51s {color} | {color:green} the patch passed with JDK v1.7.0_101 {color} | | {color:green}+1{color} | {color:green} unit
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15412627#comment-15412627 ] Ted Yu commented on HBASE-16267: {code} testReversedCompleteResultWhenRegionMove(org.apache.hadoop.hbase.TestPartialResultsFromClientSide) Time elapsed: 3.861 sec <<< ERROR! org.apache.hadoop.hbase.client.RetriesExhaustedException: Failed after attempts=36, exceptions: Mon Aug 08 21:19:54 UTC 2016, null, java.net.SocketTimeoutException: callTimeout=2000, callDuration=2174: org.apache.hadoop.hbase.NotServingRegionException: testReversedCompleteResultWhenRegionMove,,1470691190355.c6f2615b0a52b1a879e8b9298b811c0c. is closing at org.apache.hadoop.hbase.regionserver.HRegion.startRegionOperation(HRegion.java:7791) at org.apache.hadoop.hbase.regionserver.HRegion.getScanner(HRegion.java:2625) at org.apache.hadoop.hbase.regionserver.HRegion.getScanner(HRegion.java:2620) {code} The above is known flaky test. {code} org.apache.hadoop.hbase.master.procedure.TestMasterFailoverWithProcedures Time elapsed: 578.028 sec <<< ERROR! org.junit.runners.model.TestTimedOutException: test timed out after 10 minutes at java.lang.Object.wait(Native Method) at java.lang.Thread.join(Thread.java:1289) {code} Couldn't reproduce the above failure - doesn't seem to be related since only pom.xml was changed. {code} Running org.apache.hadoop.hbase.http.log.TestLogLevel Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 1.076 sec - in org.apache.hadoop.hbase.http.log.TestLogLevel {code} TestLogLevel passed. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v14.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, > 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15412630#comment-15412630 ] Ted Yu commented on HBASE-16267: If there is no objection, planning to commit v14 to master branch again since all related tests passed. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v14.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, > 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15415614#comment-15415614 ] Ted Yu commented on HBASE-16267: [~stack]: What do you think of the above ? Thanks > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v14.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, > 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15415661#comment-15415661 ] stack commented on HBASE-16267: --- Looks good in all but one regard. Looks like lots of work. Can you not purge commons-httpclient totally? We have to leave in the exclusion? Doen't this mean we are getting a class we depend on via transitive include: i.e. URIException. If we depend on it, shouldn't we add explicit dependency on commons-httpclient? But it has security issues? Better then would be to figure why we throw the URIE and if we can do without? > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v14.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, > 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15415673#comment-15415673 ] Ted Yu commented on HBASE-16267: bq. shouldn't we add explicit dependency on commons-httpclient? Dependency on org.apache.httpcomponents is specified in hbase-rest/pom.xml . commons-httpclient is the module with security vulnerabilities - so we shouldn't depend on it (explicitly). bq. why we throw the URIE I think URIE was the old way of expressing ERROR (from commons-httpclient). > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v14.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, > 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15415692#comment-15415692 ] stack commented on HBASE-16267: --- bq. ...so we shouldn't depend on it (explicitly). If security vulnerability, whats difference if included explicitly or implicitly? bq. I think URIE was the old way of expressing ERROR (from commons-httpclient). You don't have to guess. There is a trace at the head of HBASE-16361 or just undo the change here and try TestLogLevel. It looks like sun.net.www.protocol.http.HttpURLConnection.getInputStream defaults httpclient? Perhaps a config to change it to new http? > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v14.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, > 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15415701#comment-15415701 ] Ted Yu commented on HBASE-16267: bq. whats difference if included explicitly or implicitly? When dependency is implicit, we would completely get rid of security vulnerability when hadoop version is upgraded. If dependency is explicit, hbase codebase would still be vulnerable even after upgrade. bq. sun.net.www.protocol.http.HttpURLConnection.getInputStream defaults httpclient? hbase doesn't import any sun.net.\* classes - hadoop does. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v14.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, > 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15415702#comment-15415702 ] Josh Elser commented on HBASE-16267: bq. If security vulnerability, whats difference if included explicitly or implicitly? Is the vulnerability in the client itself, so by not using the older client, we're safe at runtime? Do you have the CVE handy, [~tedyu]? It would be good for us to be able to point to the issue where we addressed the CVE (since security orgs are going to approaching it that way). This would also help in our understanding here in HBase-land on the scope of the issue. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v14.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, > 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15415713#comment-15415713 ] Ted Yu commented on HBASE-16267: Updated the description with relevant JIRAs and CVE. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v14.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, > 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} > HADOOP-12767 > to move the uses of httpclient HADOOP-10105 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5262 : > http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents > HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting > during an SSL handshake, which allows remote attackers to cause a denial of > service (HTTPS call hang) via unspecified vectors. > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6153 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5783 > Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments > Service (FPS) merchant Java SDK and other products, does not verify that the > server hostname matches a domain name in the subject's Common Name (CN) or > subjectAltName field of the X.509 certificate, which allows man-in-the-middle > attackers to spoof SSL servers via an arbitrary valid certificate. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15415769#comment-15415769 ] stack commented on HBASE-16267: --- bq.hbase doesn't import any sun.net.* classes - hadoop does. You miss the point. It seems like HttpURLConnection is using httpclient as a provider. Can you change that by setting a config on the JVM? bq. If dependency is explicit, hbase codebase would still be vulnerable even after upgrade. Seems reasonable but I'd think that this reasoning on why we have references to classes from jars with vulnerabilities should be written out in code/poms/release notes. No one is going to look this far down in an issue to figure why you did something. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v14.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, > 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} > HADOOP-12767 > to move the uses of httpclient HADOOP-10105 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5262 : > http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents > HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting > during an SSL handshake, which allows remote attackers to cause a denial of > service (HTTPS call hang) via unspecified vectors. > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6153 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5783 > Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments > Service (FPS) merchant Java SDK and other products, does not verify that the > server hostname matches a domain name in the subject's Common Name (CN) or > subjectAltName field of the X.509 certificate, which allows man-in-the-middle > attackers to spoof SSL servers via an arbitrary valid certificate. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15415967#comment-15415967 ] Ted Yu commented on HBASE-16267: bq. It seems like HttpURLConnection is using httpclient as a provider. Can you change that by setting a config on the JVM? {code} HttpURLConnection connection = (HttpURLConnection)url.openConnection(); {code} HttpURLConnection is in java.net. Not sure how the provider can be changed at JVM level. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v14.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, > 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} > HADOOP-12767 > to move the uses of httpclient HADOOP-10105 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5262 : > http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents > HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting > during an SSL handshake, which allows remote attackers to cause a denial of > service (HTTPS call hang) via unspecified vectors. > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6153 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5783 > Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments > Service (FPS) merchant Java SDK and other products, does not verify that the > server hostname matches a domain name in the subject's Common Name (CN) or > subjectAltName field of the X.509 certificate, which allows man-in-the-middle > attackers to spoof SSL servers via an arbitrary valid certificate. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15416012#comment-15416012 ] stack commented on HBASE-16267: --- To remove dependency on commons-httpclient (and HttpURLConnection) by test TestLogLevel, do the following change: {code} diff --git a/hbase-server/src/test/java/org/apache/hadoop/hbase/http/log/TestLogLevel.java b/hbase-server/src/test/java/org/apache/hadoop/hbase/http/log/TestLogLevel.java index d7942d1..e14e3b4 100644 --- a/hbase-server/src/test/java/org/apache/hadoop/hbase/http/log/TestLogLevel.java +++ b/hbase-server/src/test/java/org/apache/hadoop/hbase/http/log/TestLogLevel.java @@ -61,18 +61,12 @@ public class TestLogLevel { .getConnectorAddress(0)); //servlet -URL url = new URL("http://"; + authority + "/logLevel?log=" + logName -+ "&level=" + Level.ERROR); +URL url = +new URL("http://"; + authority + "/logLevel?log=" + logName + "&level=" + Level.ERROR); out.println("*** Connecting to " + url); -HttpURLConnection connection = (HttpURLConnection)url.openConnection(); -connection.connect(); - -BufferedReader in = new BufferedReader(new InputStreamReader( -connection.getInputStream())); -for(String line; (line = in.readLine()) != null; out.println(line)); -in.close(); -connection.disconnect(); - +try (BufferedReader in = new BufferedReader(new InputStreamReader(url.openStream( { + for(String line; (line = in.readLine()) != null; out.println(line)); +} log.debug("log.debug2"); log.info("log.info2"); log.error("log.error2"); {code} It looks like there is a reference to commons httpclient in shaded module too that should be removed if purging commons httpclient. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v14.txt, 16267.v2.txt, 16267.v4.txt, 16267.v6.txt, > 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} > HADOOP-12767 > to move the uses of httpclient HADOOP-10105 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5262 : > http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents > HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting > during an SSL handshake, which allows remote attackers to cause a denial of > service (HTTPS call hang) via unspecified vectors. > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6153 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5783 > Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments > Service (FPS) merchant Java SDK and other products, does not verify that the > server hostname matches a domain name in the subject's Common Name (CN) or > subjectAltName field of the X.509 certificate, which allows man-in-the-middle > attackers to spoof SSL servers via an arbitrary valid certificate. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15416067#comment-15416067 ] stack commented on HBASE-16267: --- +1 on patch. Fix the release note. Doesn't make mention of why and doesn't make sense as written (what is the 'it' referred to). You want to hoist the CVE up into the release note? That'd help folks trying to figure why this issue. Thanks. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v14.txt, 16267.v15.txt, 16267.v2.txt, 16267.v4.txt, > 16267.v6.txt, 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} > HADOOP-12767 > to move the uses of httpclient HADOOP-10105 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5262 : > http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents > HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting > during an SSL handshake, which allows remote attackers to cause a denial of > service (HTTPS call hang) via unspecified vectors. > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6153 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5783 > Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments > Service (FPS) merchant Java SDK and other products, does not verify that the > server hostname matches a domain name in the subject's Common Name (CN) or > subjectAltName field of the X.509 certificate, which allows man-in-the-middle > attackers to spoof SSL servers via an arbitrary valid certificate. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15416460#comment-15416460 ] Ted Yu commented on HBASE-16267: I wonder what took root test(s) over two hours (4 hours since tests started - 2 hours in hbase-server). >From https://builds.apache.org/job/PreCommit-HBASE-Build/3057/console : mvn -Dmaven.repo.local=/home/jenkins/yetus-m2/hbase-master-patch-0 -DHBasePatchProcess -PrunAllTests clean test -fae > /testptch/patchprocess/patch-unit-root.txt 2>&1 > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v14.txt, 16267.v15.txt, 16267.v2.txt, 16267.v4.txt, > 16267.v6.txt, 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} > HADOOP-12767 > to move the uses of httpclient HADOOP-10105 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5262 : > http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents > HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting > during an SSL handshake, which allows remote attackers to cause a denial of > service (HTTPS call hang) via unspecified vectors. > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6153 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5783 > Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments > Service (FPS) merchant Java SDK and other products, does not verify that the > server hostname matches a domain name in the subject's Common Name (CN) or > subjectAltName field of the X.509 certificate, which allows man-in-the-middle > attackers to spoof SSL servers via an arbitrary valid certificate. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15416513#comment-15416513 ] Hadoop QA commented on HBASE-16267: --- | (x) *{color:red}-1 overall{color}* | \\ \\ || Vote || Subsystem || Runtime || Comment || | {color:blue}0{color} | {color:blue} reexec {color} | {color:blue} 21m 2s {color} | {color:blue} Docker mode activated. {color} | | {color:blue}0{color} | {color:blue} patch {color} | {color:blue} 0m 3s {color} | {color:blue} The patch file was not named according to hbase's naming conventions. Please see https://yetus.apache.org/documentation/0.3.0/precommit-patchnames for instructions. {color} | | {color:green}+1{color} | {color:green} @author {color} | {color:green} 0m 0s {color} | {color:green} The patch does not contain any @author tags. {color} | | {color:green}+1{color} | {color:green} test4tests {color} | {color:green} 0m 0s {color} | {color:green} The patch appears to include 7 new or modified test files. {color} | | {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue} 3m 46s {color} | {color:blue} Maven dependency ordering for branch {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 8m 24s {color} | {color:green} master passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 22s {color} | {color:green} master passed with JDK v1.8.0_101 {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 45s {color} | {color:green} master passed with JDK v1.7.0_101 {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 2m 59s {color} | {color:green} master passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 2m 24s {color} | {color:green} master passed {color} | | {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue} 0m 0s {color} | {color:blue} Skipped patched modules with no Java source: . {color} | | {color:red}-1{color} | {color:red} findbugs {color} | {color:red} 0m 36s {color} | {color:red} hbase-rest in master has 1 extant Findbugs warnings. {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 2m 41s {color} | {color:green} master passed with JDK v1.8.0_101 {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 3m 25s {color} | {color:green} master passed with JDK v1.7.0_101 {color} | | {color:blue}0{color} | {color:blue} mvndep {color} | {color:blue} 0m 11s {color} | {color:blue} Maven dependency ordering for patch {color} | | {color:green}+1{color} | {color:green} mvninstall {color} | {color:green} 4m 31s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 18s {color} | {color:green} the patch passed with JDK v1.8.0_101 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 3m 18s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} compile {color} | {color:green} 3m 39s {color} | {color:green} the patch passed with JDK v1.7.0_101 {color} | | {color:green}+1{color} | {color:green} javac {color} | {color:green} 3m 39s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} checkstyle {color} | {color:green} 2m 28s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} mvneclipse {color} | {color:green} 1m 45s {color} | {color:green} the patch passed {color} | | {color:green}+1{color} | {color:green} whitespace {color} | {color:green} 0m 0s {color} | {color:green} The patch has no whitespace issues. {color} | | {color:green}+1{color} | {color:green} xml {color} | {color:green} 0m 2s {color} | {color:green} The patch has no ill-formed XML file. {color} | | {color:green}+1{color} | {color:green} hadoopcheck {color} | {color:green} 32m 40s {color} | {color:green} Patch does not cause any errors with Hadoop 2.4.0 2.4.1 2.5.0 2.5.1 2.5.2 2.6.1 2.6.2 2.6.3 2.7.1. {color} | | {color:red}-1{color} | {color:red} hbaseprotoc {color} | {color:red} 0m 14s {color} | {color:red} root in the patch failed. {color} | | {color:blue}0{color} | {color:blue} findbugs {color} | {color:blue} 0m 0s {color} | {color:blue} Skipped patched modules with no Java source: . {color} | | {color:green}+1{color} | {color:green} findbugs {color} | {color:green} 2m 21s {color} | {color:green} hbase-server in the patch passed. {color} | | {color:green}+1{color} | {color:green} findbugs {color} | {color:green} 0m 57s {color} | {color:green} hbase-rest generated 0 new + 0 unchanged - 1 fixed = 0 total (was 1) {color} | | {color:green}+1{color} | {color:green} javadoc {color} | {color:green} 2m 40s {color} | {color:green} the patch passed with JDK v1.8.0_101 {color} | | {color:green}+1{color} | {color:green} j
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15416524#comment-15416524 ] Ted Yu commented on HBASE-16267: Timed out tests were not related to patch. I ran a few (TestMasterFailoverWithProcedures) locally with patch v15 and they passed. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v14.txt, 16267.v15.txt, 16267.v2.txt, 16267.v4.txt, > 16267.v6.txt, 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} > HADOOP-12767 > to move the uses of httpclient HADOOP-10105 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5262 : > http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents > HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting > during an SSL handshake, which allows remote attackers to cause a denial of > service (HTTPS call hang) via unspecified vectors. > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6153 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5783 > Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments > Service (FPS) merchant Java SDK and other products, does not verify that the > server hostname matches a domain name in the subject's Common Name (CN) or > subjectAltName field of the X.509 certificate, which allows man-in-the-middle > attackers to spoof SSL servers via an arbitrary valid certificate. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15416557#comment-15416557 ] stack commented on HBASE-16267: --- I took a look. Build times seem erratic: https://builds.apache.org/view/H-L/view/HBase/job/PreCommit-HBASE-Build/buildTimeTrend There was a 6 hour build in the mix. I am wary after HBASE-16308 went in. Will keep an eye on it. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v14.txt, 16267.v15.txt, 16267.v2.txt, 16267.v4.txt, > 16267.v6.txt, 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} > HADOOP-12767 > to move the uses of httpclient HADOOP-10105 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5262 : > http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents > HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting > during an SSL handshake, which allows remote attackers to cause a denial of > service (HTTPS call hang) via unspecified vectors. > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6153 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5783 > Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments > Service (FPS) merchant Java SDK and other products, does not verify that the > server hostname matches a domain name in the subject's Common Name (CN) or > subjectAltName field of the X.509 certificate, which allows man-in-the-middle > attackers to spoof SSL servers via an arbitrary valid certificate. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15416560#comment-15416560 ] Hadoop QA commented on HBASE-16267: --- | (x) *{color:red}-1 overall{color}* | \\ \\ || Vote || Subsystem || Runtime || Comment || | {color:blue}0{color} | {color:blue} reexec {color} | {color:blue} 0m 0s {color} | {color:blue} Docker mode activated. {color} | | {color:blue}0{color} | {color:blue} patch {color} | {color:blue} 0m 2s {color} | {color:blue} The patch file was not named according to hbase's naming conventions. Please see https://yetus.apache.org/documentation/0.3.0/precommit-patchnames for instructions. {color} | | {color:red}-1{color} | {color:red} patch {color} | {color:red} 0m 5s {color} | {color:red} HBASE-16267 does not apply to master. Rebase required? Wrong Branch? See https://yetus.apache.org/documentation/0.3.0/precommit-patchnames for help. {color} | \\ \\ || Subsystem || Report/Notes || | JIRA Patch URL | https://issues.apache.org/jira/secure/attachment/12823172/16267.v15.txt | | JIRA Issue | HBASE-16267 | | Console output | https://builds.apache.org/job/PreCommit-HBASE-Build/3061/console | | Powered by | Apache Yetus 0.3.0 http://yetus.apache.org | This message was automatically generated. > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v14.txt, 16267.v15.txt, 16267.v15.txt, 16267.v2.txt, > 16267.v4.txt, 16267.v6.txt, 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} > HADOOP-12767 > to move the uses of httpclient HADOOP-10105 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5262 : > http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents > HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting > during an SSL handshake, which allows remote attackers to cause a denial of > service (HTTPS call hang) via unspecified vectors. > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6153 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5783 > Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments > Service (FPS) merchant Java SDK and other products, does not verify that the > server hostname matches a domain name in the subject's Common Name (CN) or > subjectAltName field of the X.509 certificate, which allows man-in-the-middle > attackers to spoof SSL servers via an arbitrary valid certificate. -- This message was sent by Atlassian JIRA (v6.3.4#6332)
[jira] [Commented] (HBASE-16267) Remove commons-httpclient dependency from hbase-rest module
[ https://issues.apache.org/jira/browse/HBASE-16267?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15416621#comment-15416621 ] Hudson commented on HBASE-16267: FAILURE: Integrated in HBase-Trunk_matrix #1394 (See [https://builds.apache.org/job/HBase-Trunk_matrix/1394/]) HBASE-16267 Remove commons-httpclient dependency from hbase-rest module (tedyu: rev fb668a0d3f8bde2e228527a9c45d0458ea7597e8) * hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestSchemaResource.java * hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/client/Client.java * hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/client/Response.java * hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/MultiRowResource.java * hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestScannerResource.java * hbase-server/src/test/java/org/apache/hadoop/hbase/http/log/TestLogLevel.java * hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestGetAndPutResource.java * hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/client/TestRemoteTable.java * hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestMultiRowResource.java * hbase-rest/pom.xml * pom.xml * hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestGzipFilter.java > Remove commons-httpclient dependency from hbase-rest module > --- > > Key: HBASE-16267 > URL: https://issues.apache.org/jira/browse/HBASE-16267 > Project: HBase > Issue Type: Bug >Reporter: Ted Yu >Assignee: Ted Yu >Priority: Critical > Fix For: 2.0.0 > > Attachments: 16267.v10.txt, 16267.v11.txt, 16267.v12.txt, > 16267.v13.txt, 16267.v14.txt, 16267.v15.txt, 16267.v15.txt, 16267.v2.txt, > 16267.v4.txt, 16267.v6.txt, 16267.v8.txt, 16267.v9.txt > > > hbase-rest module still has imports from org.apache.commons.httpclient . > There is more work to be done after HBASE-15767 was integrated. > In master branch, there seems to be transitive dependency which allows the > code to compile: > {code} > [INFO] +- org.apache.hadoop:hadoop-common:jar:2.7.1:compile > [INFO] | +- org.apache.hadoop:hadoop-annotations:jar:2.7.1:compile > [INFO] | +- commons-cli:commons-cli:jar:1.2:compile > [INFO] | +- org.apache.commons:commons-math3:jar:3.1.1:compile > [INFO] | +- xmlenc:xmlenc:jar:0.52:compile > [INFO] | +- commons-httpclient:commons-httpclient:jar:3.1:compile > {code} > HADOOP-12767 > to move the uses of httpclient HADOOP-10105 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5262 : > http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents > HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting > during an SSL handshake, which allows remote attackers to cause a denial of > service (HTTPS call hang) via unspecified vectors. > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6153 > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5783 > Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments > Service (FPS) merchant Java SDK and other products, does not verify that the > server hostname matches a domain name in the subject's Common Name (CN) or > subjectAltName field of the X.509 certificate, which allows man-in-the-middle > attackers to spoof SSL servers via an arbitrary valid certificate. -- This message was sent by Atlassian JIRA (v6.3.4#6332)