This is an automated email from the ASF dual-hosted git repository.
yiguolei pushed a commit to branch branch-4.2
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/branch-4.2 by this push:
new d10599dc0c6 branch-4.2: [fix](fe) Update vulnerable dependencies
(#69364)
d10599dc0c6 is described below
commit d10599dc0c61fd88ac6e88b03288cd41fde9f1c9
Author: Calvin Kirs <[email protected]>
AuthorDate: Fri Oct 23 09:59:49 2026 +0800
branch-4.2: [fix](fe) Update vulnerable dependencies (#69364)
Backport #69334 to branch-4.2: upgrade vulnerable FE dependencies and
remove unused transitive libraries. The unsuppressed OWASP scan matches
the 4.1 final scan (54 flagged dependencies, 118 unique CVEs).
Validation: FE package build and 21 targeted HTTP, COS, Hive UDF, and
Avro tests passed.
Release note: None.
---
.../org/apache/doris/avro/HDFSFileReaderTest.java | 72 ++++++++++++++++++++
fe/fe-core/pom.xml | 3 +-
.../trees/expressions/literal/JsonLiteralTest.java | 6 +-
fe/hive-udf/pom.xml | 66 ++++++++++++++++++
fe/pom.xml | 79 ++++++++++++++++++++--
5 files changed, 215 insertions(+), 11 deletions(-)
diff --git
a/fe/be-java-extensions/avro-scanner/src/test/java/org/apache/doris/avro/HDFSFileReaderTest.java
b/fe/be-java-extensions/avro-scanner/src/test/java/org/apache/doris/avro/HDFSFileReaderTest.java
new file mode 100644
index 00000000000..cba75fa7fb2
--- /dev/null
+++
b/fe/be-java-extensions/avro-scanner/src/test/java/org/apache/doris/avro/HDFSFileReaderTest.java
@@ -0,0 +1,72 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.doris.avro;
+
+import org.apache.avro.Schema;
+import org.apache.avro.SchemaBuilder;
+import org.apache.avro.file.DataFileWriter;
+import org.apache.avro.generic.GenericData;
+import org.apache.avro.generic.GenericDatumWriter;
+import org.apache.avro.generic.GenericRecord;
+import org.apache.avro.mapred.AvroWrapper;
+import org.apache.avro.mapred.Pair;
+import org.apache.hadoop.io.NullWritable;
+import org.junit.Assert;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.TemporaryFolder;
+
+import java.io.File;
+import java.util.Collections;
+
+public class HDFSFileReaderTest {
+ @Rule
+ public TemporaryFolder temporaryFolder = new TemporaryFolder();
+
+ @Test
+ public void testReadProjectedFile() throws Exception {
+ Schema schema = SchemaBuilder.record("row").fields()
+ .requiredInt("id").requiredString("name").endRecord();
+ File file = temporaryFolder.newFile("records.avro");
+ try (DataFileWriter<GenericRecord> writer = new DataFileWriter<>(new
GenericDatumWriter<>(schema))) {
+ writer.create(schema, file);
+ GenericRecord record = new GenericData.Record(schema);
+ record.put("id", 7);
+ record.put("name", "seven");
+ writer.append(record);
+ }
+
+ AvroFileContext context = new AvroFileContext();
+ context.setRequiredFields(Collections.singleton("id"));
+ context.setSplitStartOffset(0L);
+ context.setSplitSize(file.length());
+ HDFSFileReader reader = new HDFSFileReader(file.toURI().toString());
+ reader.open(context, false);
+ try {
+ AvroWrapper<Pair<Integer, Long>> input = new AvroWrapper<>();
+ Assert.assertEquals(schema, reader.getSchema());
+ Assert.assertTrue(reader.hasNext(input, NullWritable.get()));
+ GenericRecord record = (GenericRecord) reader.getNext();
+ Assert.assertEquals(7, record.get("id"));
+ Assert.assertNull(record.getSchema().getField("name"));
+ Assert.assertFalse(reader.hasNext(input, NullWritable.get()));
+ } finally {
+ reader.close();
+ }
+ }
+}
diff --git a/fe/fe-core/pom.xml b/fe/fe-core/pom.xml
index 1b3c79d796b..c3e2d018cfd 100644
--- a/fe/fe-core/pom.xml
+++ b/fe/fe-core/pom.xml
@@ -867,7 +867,8 @@ under the License.
<dependency>
<groupId>com.taobao.arthas</groupId>
<artifactId>arthas-packaging</artifactId>
- <version>4.0.5</version>
+ <!-- Arthas embeds its own Netty; the FE BOM cannot update that
copy. -->
+ <version>4.3.5</version>
</dependency>
<dependency>
<groupId>org.mockito</groupId>
diff --git
a/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/expressions/literal/JsonLiteralTest.java
b/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/expressions/literal/JsonLiteralTest.java
index 6e16ea9805e..d74630974c7 100644
---
a/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/expressions/literal/JsonLiteralTest.java
+++
b/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/expressions/literal/JsonLiteralTest.java
@@ -103,17 +103,17 @@ public class JsonLiteralTest {
@Test
public void testLoneHighSurrogateInObjectKey() {
- // lone surrogate in object field name must also be rejected
+ // Jackson may reject invalid field names before Doris validates the
parsed tree.
AnalysisException ex = Assertions.assertThrows(AnalysisException.class,
() -> new JsonLiteral("{\"\\uD800\":\"value\"}"));
- Assertions.assertTrue(ex.getMessage().contains("lone high surrogate"));
+ Assertions.assertTrue(ex.getMessage().contains("surrogate"));
}
@Test
public void testLoneLowSurrogateInObjectKey() {
AnalysisException ex = Assertions.assertThrows(AnalysisException.class,
() -> new JsonLiteral("{\"\\uDC00\":\"value\"}"));
- Assertions.assertTrue(ex.getMessage().contains("lone low surrogate"));
+ Assertions.assertTrue(ex.getMessage().contains("surrogate"));
}
@Test
diff --git a/fe/hive-udf/pom.xml b/fe/hive-udf/pom.xml
index 83bb1f7c42f..aae9666ed43 100644
--- a/fe/hive-udf/pom.xml
+++ b/fe/hive-udf/pom.xml
@@ -52,8 +52,40 @@ under the License.
<groupId>org.apache.hive</groupId>
<artifactId>hive-exec</artifactId>
<version>${hive.version}</version>
+ <!-- The core artifact contains the UDF API without Hive's bundled
old libraries. -->
+ <classifier>core</classifier>
<scope>provided</scope>
<exclusions>
+ <!-- UDFs do not use LLAP, YARN APIs, or ZooKeeper. -->
+ <exclusion>
+ <groupId>org.apache.hive</groupId>
+ <artifactId>hive-llap-tez</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.hadoop</groupId>
+ <artifactId>hadoop-yarn-api</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.hadoop</groupId>
+ <artifactId>hadoop-yarn-common</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.hadoop</groupId>
+ <artifactId>hadoop-yarn-registry</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.zookeeper</groupId>
+ <artifactId>zookeeper</artifactId>
+ </exclusion>
+ <!-- UDFs do not use YARN's server or the metastore's legacy
FB303 service. -->
+ <exclusion>
+ <groupId>org.apache.hadoop</groupId>
+ <artifactId>hadoop-yarn-server-resourcemanager</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.thrift</groupId>
+ <artifactId>libfb303</artifactId>
+ </exclusion>
<exclusion>
<groupId>org.apache.calcite</groupId>
<artifactId>calcite-core</artifactId>
@@ -62,12 +94,46 @@ under the License.
<groupId>org.apache.calcite</groupId>
<artifactId>calcite-druid</artifactId>
</exclusion>
+ <!-- UDFs do not use Hive's JDBC driver or its bundled legacy
dependencies. -->
+ <exclusion>
+ <groupId>org.apache.calcite.avatica</groupId>
+ <artifactId>avatica</artifactId>
+ </exclusion>
<exclusion>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
</exclusion>
</exclusions>
</dependency>
+ <dependency>
+ <groupId>org.apache.hive</groupId>
+ <artifactId>hive-serde</artifactId>
+ <version>${hive.version}</version>
+ <scope>provided</scope>
+ <exclusions>
+ <exclusion>
+ <groupId>org.apache.thrift</groupId>
+ <artifactId>libfb303</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.hive</groupId>
+ <artifactId>hive-common</artifactId>
+ <version>${hive.version}</version>
+ <scope>provided</scope>
+ <exclusions>
+ <!-- Generic UDFs need Hive types, not Hive's embedded web
server or console. -->
+ <exclusion>
+ <groupId>org.eclipse.jetty</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>jline</groupId>
+ <artifactId>jline</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
<dependency>
<groupId>${project.groupId}</groupId>
<artifactId>fe-common</artifactId>
diff --git a/fe/pom.xml b/fe/pom.xml
index 4f0a24ee4ca..1f7c38c4028 100644
--- a/fe/pom.xml
+++ b/fe/pom.xml
@@ -234,14 +234,15 @@ under the License.
<doris.hive.catalog.shade.version>3.1.3</doris.hive.catalog.shade.version>
<!-- iceberg 1.9.1 depends avro on 1.12 -->
<avro.version>1.12.1</avro.version>
- <parquet.version>1.18.0</parquet.version>
+ <!-- Disable file-controlled KMS URLs by default (CVE-2026-73334). -->
+ <parquet.version>1.18.1</parquet.version>
<spark.version>3.4.3</spark.version>
<hudi.version>1.0.2</hudi.version>
<obs.dependency.scope>compile</obs.dependency.scope>
<cos.dependency.scope>compile</cos.dependency.scope>
<qcloud-java-sdk.version>2.0.1</qcloud-java-sdk.version>
<tencentcos.version>8.2.7</tencentcos.version>
- <cos-api.version>5.6.211</cos-api.version>
+ <cos-api.version>5.6.269</cos-api.version>
<tencentcloud-sdk-java-sts.version>3.1.678</tencentcloud-sdk-java-sts.version>
<huaweicloud-sdk-iam.version>3.1.20</huaweicloud-sdk-iam.version>
<esdk-obs.version>3.21.11</esdk-obs.version>
@@ -271,9 +272,8 @@ under the License.
<commons-validator.version>1.9.0</commons-validator.version>
<gson.version>2.10.1</gson.version>
<guava.version>33.2.1-jre</guava.version>
- <!-- Jackson 2.16.0 is affected by multiple 2026 parser and
polymorphic-deserialization
- vulnerabilities, including CVE-2026-54512. Version 2.21.5
contains the complete fixes. -->
- <jackson.version>2.21.5</jackson.version>
+ <!-- Keep Jackson 2 aligned on the LTS maintenance release fixing
CVE-2026-110879. -->
+ <jackson.version>2.21.8</jackson.version>
<javassist.version>3.18.2-GA</javassist.version>
<javax.servlet-api.version>3.1.0</javax.servlet-api.version>
<!-- Spring Framework 7 and Jetty EE11 require Jakarta Servlet 6.1. -->
@@ -294,7 +294,7 @@ under the License.
<metrics-core.version>4.0.2</metrics-core.version>
<resilience4j.version>2.4.0</resilience4j.version>
<!-- Keep Netty compatible with Arrow Flight SQL 19 and other
transitive Netty users. -->
- <netty-all.version>4.2.17.Final</netty-all.version>
+ <netty-all.version>4.2.18.Final</netty-all.version>
<!-- OpenTelemetry versions before 1.62.0 allow unbounded allocation
while parsing W3C
baggage (CVE-2026-45292); align the complete OpenTelemetry graph
on the fixed BOM. -->
<opentelemetry.version>1.62.0</opentelemetry.version>
@@ -324,6 +324,7 @@ under the License.
<jetty-servlet.version>11.0.26</jetty-servlet.version>
<jetty-websocket.version>9.4.58.v20250814</jetty-websocket.version>
<okhttp.version>5.3.2</okhttp.version>
+ <okio.version>3.16.4</okio.version>
<snakeyaml.version>2.6</snakeyaml.version>
<validation-api.version>2.0.1.Final</validation-api.version>
<zjsonpatch.version>0.2.3</zjsonpatch.version>
@@ -411,7 +412,10 @@ under the License.
<lz4-java-relocation.version>1.8.1</lz4-java-relocation.version>
<lz4-java.version>1.11.1</lz4-java.version>
<immutables.version>2.9.3</immutables.version>
- <ivy.version>2.5.2</ivy.version>
+ <!-- Fix PackagerResolver path traversal (CVE-2026-26032). -->
+ <ivy.version>2.6.0</ivy.version>
+ <ant.version>1.10.18</ant.version>
+ <groovy-all.version>2.4.21</groovy-all.version>
<icu4j.version>78.1</icu4j.version>
<ini4j.version>0.5.4</ini4j.version>
<!--todo waiting release-->
@@ -494,6 +498,14 @@ under the License.
<type>pom</type>
<scope>import</scope>
</dependency>
+ <!-- Align legacy cloud clients with the Okio version used by
OkHttp 5. -->
+ <dependency>
+ <groupId>com.squareup.okio</groupId>
+ <artifactId>okio-bom</artifactId>
+ <version>${okio.version}</version>
+ <type>pom</type>
+ <scope>import</scope>
+ </dependency>
<dependency>
<groupId>io.grpc</groupId>
<artifactId>grpc-bom</artifactId>
@@ -548,6 +560,22 @@ under the License.
<artifactId>ivy</artifactId>
<version>${ivy.version}</version>
</dependency>
+ <!-- Hive's provided dependencies also need the Ant and Groovy
security fixes. -->
+ <dependency>
+ <groupId>org.apache.ant</groupId>
+ <artifactId>ant</artifactId>
+ <version>${ant.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.ant</groupId>
+ <artifactId>ant-launcher</artifactId>
+ <version>${ant.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.codehaus.groovy</groupId>
+ <artifactId>groovy-all</artifactId>
+ <version>${groovy-all.version}</version>
+ </dependency>
<dependency>
<groupId>org.eclipse.jetty.websocket</groupId>
<artifactId>websocket-client</artifactId>
@@ -1116,6 +1144,15 @@ under the License.
<artifactId>ranger-plugins-common</artifactId>
<version>${ranger-plugins-common.version}</version>
<exclusions>
+ <!-- Use Doris's Hadoop modules; these duplicates bundle
old private dependencies. -->
+ <exclusion>
+ <groupId>org.apache.hadoop</groupId>
+ <artifactId>hadoop-client-api</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.hadoop</groupId>
+ <artifactId>hadoop-client-runtime</artifactId>
+ </exclusion>
<exclusion>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
@@ -1550,6 +1587,13 @@ under the License.
<groupId>org.apache.avro</groupId>
<artifactId>avro-mapred</artifactId>
<version>${avro.version}</version>
+ <exclusions>
+ <!-- Scanners read Avro files and do not start Avro's
Jetty RPC server. -->
+ <exclusion>
+ <groupId>org.apache.avro</groupId>
+ <artifactId>avro-ipc-jetty</artifactId>
+ </exclusion>
+ </exclusions>
</dependency>
<!--
https://mvnrepository.com/artifact/org.apache.hudi/hudi-common -->
<dependency>
@@ -1592,6 +1636,11 @@ under the License.
<artifactId>hbase-server</artifactId>
<version>${hbase.version}</version>
<exclusions>
+ <!-- Hudi reads HFiles and does not start HBase's embedded
HTTP server. -->
+ <exclusion>
+ <groupId>org.apache.hbase</groupId>
+ <artifactId>hbase-http</artifactId>
+ </exclusion>
<exclusion>
<groupId>org.apache.hbase</groupId>
<artifactId>hbase-hadoop2-compat</artifactId>
@@ -1654,6 +1703,11 @@ under the License.
<artifactId>parquet-hadoop</artifactId>
<version>${parquet.version}</version>
</dependency>
+ <dependency>
+ <groupId>org.apache.parquet</groupId>
+ <artifactId>parquet-hadoop-bundle</artifactId>
+ <version>${parquet.version}</version>
+ </dependency>
<dependency>
<groupId>org.apache.parquet</groupId>
<artifactId>parquet-common</artifactId>
@@ -1769,6 +1823,11 @@ under the License.
<artifactId>hadoop-mapreduce-client-core</artifactId>
<version>${hadoop.version}</version>
<exclusions>
+ <!-- File readers do not submit YARN jobs; this client
brings EOL Jetty 9 WebSockets. -->
+ <exclusion>
+ <groupId>org.apache.hadoop</groupId>
+ <artifactId>hadoop-yarn-client</artifactId>
+ </exclusion>
<exclusion>
<groupId>javax.servlet</groupId>
<artifactId>servlet-api</artifactId>
@@ -2004,6 +2063,12 @@ under the License.
</exclusion>
</exclusions>
</dependency>
+ <!-- hadoop-cos uses classes inside this shaded bundle; keep both
COS SDK artifacts aligned. -->
+ <dependency>
+ <groupId>com.qcloud</groupId>
+ <artifactId>cos_api-bundle</artifactId>
+ <version>${cos-api.version}</version>
+ </dependency>
<dependency>
<groupId>com.qcloud</groupId>
<artifactId>qcloud-java-sdk</artifactId>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
