github-advanced-security[bot] commented on code in PR #16620:
URL: https://github.com/apache/druid/pull/16620#discussion_r1668001353
##########
processing/src/main/java/org/apache/druid/query/groupby/epinephelinae/RowBasedGrouperHelper.java:
##########
@@ -1371,6 +1361,79 @@
);
}
+ @Override
+ public ObjectMapper decorateObjectMapper(ObjectMapper spillMapper)
+ {
+
+ final JsonDeserializer<RowBasedKey> deserializer = new
JsonDeserializer<RowBasedKey>()
+ {
+ @Override
+ public RowBasedKey deserialize(
+ JsonParser jp,
+ DeserializationContext deserializationContext
+ ) throws IOException
+ {
+ if (!jp.isExpectedStartArrayToken()) {
+ throw DruidException.defensive("Expected array start token,
received [%s]", jp.getCurrentToken());
+ }
+ jp.nextToken();
+
+ final ObjectCodec codec = jp.getCodec();
+ final int timestampAdjustment = includeTimestamp ? 1 : 0;
+ final int dimsToRead = timestampAdjustment + serdeHelpers.length;
+ int dimsReadSoFar = 0;
+ final Object[] objects = new Object[dimsToRead];
+
+ if (includeTimestamp) {
+ DruidException.conditionalDefensive(
+ jp.currentToken() != JsonToken.END_ARRAY,
+ "Unexpected end of array when deserializing timestamp from the
spilled files"
+ );
+ objects[dimsReadSoFar] = codec.readValue(jp, Long.class);
+
+ ++dimsReadSoFar;
+ jp.nextToken();
+ }
+
+ while (jp.currentToken() != JsonToken.END_ARRAY) {
+
+ DruidException.conditionalDefensive(
+ dimsReadSoFar < dimsToRead,
+ "More dimensions encountered than expected [%d]",
+ dimsToRead
+ );
+
+ DruidException.conditionalDefensive(
+ dimsReadSoFar - timestampAdjustment < serdeHelpers.length,
+ "Insufficient serde helpers present"
+ );
+
+ // Read the dimension
+ serdeHelpers[dimsReadSoFar - timestampAdjustment].getClazz();
+ objects[dimsReadSoFar] =
+ codec.readValue(jp, serdeHelpers[dimsReadSoFar -
timestampAdjustment].getClazz());
Review Comment:
## Array index out of bounds
This array access might be out of bounds, as the index might be equal to the
array length.
[Show more
details](https://github.com/apache/druid/security/code-scanning/7542)
##########
processing/src/main/java/org/apache/druid/query/QueryToolChest.java:
##########
@@ -251,19 +251,36 @@
*/
public abstract TypeReference<ResultType> getResultTypeReference();
+ /**
+ * Like {@link #getCacheStrategy(Query, ObjectMapper)} but the caller
doesn't supply the object mapper for deserializing
+ * and converting the cached data to desired type. It's upto the individual
implementations to decide the appropriate action in that case.
+ * It can either throw an exception outright or decide if the query requires
the object mapper for proper downstream processing and
+ * work with the generic java types if not.
+ * <p>
+ * @deprecated Use {@link #getCacheStrategy(Query, ObjectMapper)} instead
+ */
+ @Deprecated
+ @Nullable
+ public <T> CacheStrategy<ResultType, T, QueryType>
getCacheStrategy(QueryType query)
+ {
+ return null;
+ }
+
/**
* Returns a CacheStrategy to be used to load data into the cache and remove
it from the cache.
* <p>
* This is optional. If it returns null, caching is effectively disabled
for the query.
*
* @param query The query whose results might be cached
+ * @param mapper Object mapper to convert the deserialized generic java
objects to desired types. It can be nullable
+ * to preserve backward compatibility.
* @param <T> The type of object that will be stored in the cache
* @return A CacheStrategy that can be used to populate and read from the
Cache
*/
@Nullable
- public <T> CacheStrategy<ResultType, T, QueryType>
getCacheStrategy(QueryType query)
+ public <T> CacheStrategy<ResultType, T, QueryType>
getCacheStrategy(QueryType query, @Nullable ObjectMapper mapper)
{
- return null;
+ return getCacheStrategy(query);
Review Comment:
## Deprecated method or constructor invocation
Invoking [QueryToolChest.getCacheStrategy](1) should be avoided because it
has been deprecated.
[Show more
details](https://github.com/apache/druid/security/code-scanning/7543)
##########
processing/src/main/java/org/apache/druid/query/groupby/epinephelinae/RowBasedGrouperHelper.java:
##########
@@ -1371,6 +1361,79 @@
);
}
+ @Override
+ public ObjectMapper decorateObjectMapper(ObjectMapper spillMapper)
+ {
+
+ final JsonDeserializer<RowBasedKey> deserializer = new
JsonDeserializer<RowBasedKey>()
+ {
+ @Override
+ public RowBasedKey deserialize(
+ JsonParser jp,
+ DeserializationContext deserializationContext
+ ) throws IOException
+ {
+ if (!jp.isExpectedStartArrayToken()) {
+ throw DruidException.defensive("Expected array start token,
received [%s]", jp.getCurrentToken());
+ }
+ jp.nextToken();
+
+ final ObjectCodec codec = jp.getCodec();
+ final int timestampAdjustment = includeTimestamp ? 1 : 0;
+ final int dimsToRead = timestampAdjustment + serdeHelpers.length;
+ int dimsReadSoFar = 0;
+ final Object[] objects = new Object[dimsToRead];
+
+ if (includeTimestamp) {
+ DruidException.conditionalDefensive(
+ jp.currentToken() != JsonToken.END_ARRAY,
+ "Unexpected end of array when deserializing timestamp from the
spilled files"
+ );
+ objects[dimsReadSoFar] = codec.readValue(jp, Long.class);
+
+ ++dimsReadSoFar;
+ jp.nextToken();
+ }
+
+ while (jp.currentToken() != JsonToken.END_ARRAY) {
+
+ DruidException.conditionalDefensive(
+ dimsReadSoFar < dimsToRead,
+ "More dimensions encountered than expected [%d]",
+ dimsToRead
+ );
+
+ DruidException.conditionalDefensive(
+ dimsReadSoFar - timestampAdjustment < serdeHelpers.length,
+ "Insufficient serde helpers present"
+ );
+
+ // Read the dimension
+ serdeHelpers[dimsReadSoFar - timestampAdjustment].getClazz();
Review Comment:
## Array index out of bounds
This array access might be out of bounds, as the index might be equal to the
array length.
[Show more
details](https://github.com/apache/druid/security/code-scanning/7541)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
