[jira] [Commented] (AVRO-3551) Security Vulnerability - WS-2022-0161 in Newtonsoft dependendy

[Kalle Niemitalo (Jira)]

    [ 
https://issues.apache.org/jira/browse/AVRO-3551?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17562119#comment-17562119
 ] 

Kalle Niemitalo commented on AVRO-3551:
---------------------------------------

The public or protected API currently depends on Newtonsoft.Json.Linq.JToken or 
Newtonsoft.Json.JsonTextWriter in a few places:

{code:C#}
namespace Avro {
    public partial class ArraySchema {
        protected internal override void 
WriteJsonFields(Newtonsoft.Json.JsonTextWriter writer, SchemaNames names, 
string encspace);
    }

    public partial class EnumSchema {
        protected internal override void 
WriteJsonFields(Newtonsoft.Json.JsonTextWriter writer, SchemaNames names, 
string encspace);
    }

    public partial class Field {
        public JToken DefaultValue { get; private set; }

        public Field(Schema schema, string name, int pos, IList<string> aliases 
= null, string doc = null, JToken defaultValue = null, SortOrder sortorder = 
SortOrder.ignore, PropertyMap customProperties = null);

        protected internal void writeJson(JsonTextWriter writer, SchemaNames 
names, string encspace)
    }

    public partial class FixedSchema {
        protected internal override void 
WriteJsonFields(Newtonsoft.Json.JsonTextWriter writer, SchemaNames names, 
string encspace);
    }

    public partial class LogicalSchema {
        protected internal override void 
WriteJson(Newtonsoft.Json.JsonTextWriter writer, SchemaNames names, string 
encspace);
    }

    public partial class MapSchema {
        protected internal override void 
WriteJsonFields(Newtonsoft.Json.JsonTextWriter writer, SchemaNames names, 
string encspace);
    }

    public abstract partial class NamedSchema {
        protected static SchemaName GetName(JToken jtok, string encspace);

        protected static IList<SchemaName> GetAliases(JToken jtok, string 
space, string encspace);

        protected internal override void 
WriteJson(Newtonsoft.Json.JsonTextWriter writer, SchemaNames names, string 
encspace);

        protected internal override void 
WriteJsonFields(Newtonsoft.Json.JsonTextWriter writer, SchemaNames names, 
string encspace);
    }

    public sealed partial class PrimitiveSchema {
        // OK because sealed
        protected internal override void WriteJson(JsonTextWriter w, 
SchemaNames names, string encspace);
    }

    public partial class PropertyMap {
        public void Parse(JToken jtok);

        public void WriteJson(JsonTextWriter writer);
    }

    public partial class RecordSchema {
        protected internal override void 
WriteJsonFields(Newtonsoft.Json.JsonTextWriter writer, SchemaNames names, 
string encspace);
    }

    public partial class Schema {
        protected internal virtual void WriteJsonFields(JsonTextWriter writer, 
SchemaNames names, string encspace);

        protected internal virtual void WriteJson(JsonTextWriter writer, 
SchemaNames names, string encspace);
    }

    public partial class UnionSchema {
        protected internal override void 
WriteJson(Newtonsoft.Json.JsonTextWriter writer, SchemaNames names, string 
encspace);
    }
}

namespace Avro.Reflect {
    public partial class ReflectDefaultReader {
        public object GetDefaultValue(Schema s, JToken defaultValue);
    }
}
{code}

Switching to System.Text.Json would break this API so I don't think it should 
be done on the 1.11 branch.

If anyone is even willing to implement such a change. There are other bugs that 
are not so easy to work around.

> Security Vulnerability - WS-2022-0161 in Newtonsoft dependendy
> --------------------------------------------------------------
>
>                 Key: AVRO-3551
>                 URL: https://issues.apache.org/jira/browse/AVRO-3551
>             Project: Apache Avro
>          Issue Type: Bug
>          Components: csharp
>    Affects Versions: 1.11.0
>            Reporter: Michael Ahrens
>            Priority: Major
>
> Please upgrade Newtonsoft dependency to 13.0.1 in next version. Below 
> versions have a security vulnerability: WS-2022-0161
> Thanks
> Michael



--
This message was sent by Atlassian Jira
(v8.20.10#820010)