FrankChen021 opened a new pull request, #19828: URL: https://github.com/apache/druid/pull/19828
Created by GPT-5.6-Sol. ## Summary - write encrypted payloads with a versioned AES-GCM envelope using fresh 96-bit IVs and 128-bit authentication tags - retain narrowly scoped legacy CBC decryption so short-lived pac4j cookies survive rolling upgrades, while never writing new CBC ciphertext - harden encrypted-payload length parsing and cover tampering, downgrade, malformed input, wrong keys, and a fixed legacy fixture - replace the JavaScript aggregator SHA-1 cache fingerprint with SHA-256 - document the fixed-seed, single-use Random in the Memcached benchmark as intentional deterministic benchmark data This addresses all four CodeQL cryptography-group warnings: three direct cryptographic upgrades and one precise benchmark-only suppression. ## Validation - CryptoServiceTest: 9 passed - Pac4jSessionStoreTest: 12 passed - JavaScriptAggregatorTest: 7 passed - server test compilation, Checkstyle, PMD, and forbidden-API checks passed - git diff --check passed -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
