amaechler commented on code in PR #20826:
URL: https://github.com/apache/druid/pull/20826#discussion_r4456426380
##########
extensions-core/orc-extensions/pom.xml:
##########
@@ -34,6 +34,16 @@
<hive-storage-api.version>4.2.0</hive-storage-api.version>
<orc.version>2.3.1</orc.version>
</properties>
+ <dependencyManagement>
+ <dependencies>
+ <!-- override the transitive dependency from orc-core 2.3.1 to
address CVE-2026-111497 -->
+ <dependency>
+ <groupId>com.aayushatharva.brotli4j</groupId>
+ <artifactId>brotli4j</artifactId>
+ <version>1.24.0</version>
Review Comment:
No ORC extension test uses Brotli compression, so CI passes without ever
loading the new native library (bundled Brotli goes from 1.1.0 to 1.2.1, and
1.24.0 also changes how the native library is unpacked). I ran a write/read
round trip locally on macOS aarch64 and it passed. A small test in
`OrcReaderTest` would cover Linux in CI and catch future bumps, for example:
```java
@Test
public void testBrotliRoundTrip() throws IOException
{
final Configuration conf = new Configuration();
final Path path = new Path(temporaryFolder.newFile().getAbsolutePath());
final TypeDescription schema =
TypeDescription.fromString("struct<s:string>");
try (Writer writer = OrcFile.createWriter(
path,
OrcFile.writerOptions(conf).setSchema(schema).compress(CompressionKind.BROTLI).overwrite(true)
)) {
final VectorizedRowBatch batch = schema.createRowBatch();
((BytesColumnVector) batch.cols[0]).setVal(batch.size++,
StringUtils.toUtf8("foo"));
writer.addRowBatch(batch);
}
try (Reader reader = OrcFile.createReader(path,
OrcFile.readerOptions(conf))) {
Assertions.assertEquals(CompressionKind.BROTLI,
reader.getCompressionKind());
final VectorizedRowBatch batch = reader.getSchema().createRowBatch();
Assertions.assertTrue(reader.rows().nextBatch(batch));
Assertions.assertEquals("foo", ((BytesColumnVector)
batch.cols[0]).toString(0));
}
}
```
##########
extensions-core/orc-extensions/pom.xml:
##########
@@ -34,6 +34,16 @@
<hive-storage-api.version>4.2.0</hive-storage-api.version>
<orc.version>2.3.1</orc.version>
</properties>
+ <dependencyManagement>
+ <dependencies>
+ <!-- override the transitive dependency from orc-core 2.3.1 to
address CVE-2026-111497 -->
+ <dependency>
+ <groupId>com.aayushatharva.brotli4j</groupId>
+ <artifactId>brotli4j</artifactId>
+ <version>1.24.0</version>
Review Comment:
Could the pin be a property next to `orc.version`? A later ORC upgrade that
brings a newer brotli4j would otherwise be held at 1.24.0 by this override
without anyone noticing. With the property, whoever bumps `orc.version` sees
the pin right next to it.
```suggestion
<orc.version>2.3.1</orc.version>
<brotli4j.version>1.24.0</brotli4j.version>
</properties>
<dependencyManagement>
<dependencies>
<!-- override the transitive dependency from orc-core 2.3.1 to
address CVE-2026-111497 -->
<dependency>
<groupId>com.aayushatharva.brotli4j</groupId>
<artifactId>brotli4j</artifactId>
<version>${brotli4j.version}</version>
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
