bharos commented on PR #11506:
URL: https://github.com/apache/gravitino/pull/11506#issuecomment-4661342330
> @bharos I could not see the jar you are intending to exclude from the
distribution package based on the current main branch, so if I'm not wrong,
this PR will not affect the final result of the distribution package. Is that
true?
You're right that log4j:log4j does not end up in the distribution package ,
it's not in the runtimeClasspath of any module.
However, it is still resolved on the current main branch as a transitive
test dependency:
```
./gradlew :catalogs:catalog-lakehouse-paimon:dependencies --configuration
testRuntimeClasspath | grep "log4j:log4j:"
| | | | | | | \--- log4j:log4j:1.2.17
(base) ╭─bmurali@FVFHP28PQ05N ~/Code/gravitino ‹main*›
╰─➤ ./gradlew :catalogs:catalog-hive:dependencies --configuration
testRuntimeClasspath | grep "log4j:log4j:"
| | \--- log4j:log4j:1.2.17
| | | | | | \--- log4j:log4j:1.2.17
| | | | | +--- log4j:log4j:1.2.17
```
This means the vulnerable JAR still gets downloaded to ~/.gradle/caches/
during builds and test runs, which triggers security scanners on developer
machines (which is how I found it - our vulnerability scanner flagged it
repeatedly on my laptop).
This global exclusion serves as defense-in-depth: it prevents the JAR from
being resolved anywhere (including test configurations), and ensures that if a
future module introduces a new transitive dependency on log4j 1.x, it will be
caught automatically rather than requiring per-module exclusions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
