[
https://issues.apache.org/jira/browse/DRILL-7936?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17352667#comment-17352667
]
ASF GitHub Bot commented on DRILL-7936:
---------------------------------------
laurentgo opened a new pull request #2240:
URL: https://github.com/apache/drill/pull/2240
# [DRILL-7936](https://issues.apache.org/jira/browse/DRILL-7936): Remove
usage of Guava Files#createTempDir method
## Description
Guava's `Files#createTempDir()` method has some security issues, and since
better alternatives exist (including Java 7 `Files#createTempDirectory(String)`
method), the function has been deprecated in Guava 30.0 (but the security
issues haven't been addressed).
Introduce a drop-in replacement for this method in `DrillFileUtils` based on
the Java7 Files API and replace usage of the Guava method with the new method
in the codebase.
## Documentation
N/A
## Testing
Unit tests run locally
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
> Remove Guava Files#createTempDir usage
> --------------------------------------
>
> Key: DRILL-7936
> URL: https://issues.apache.org/jira/browse/DRILL-7936
> Project: Apache Drill
> Issue Type: Bug
> Reporter: Laurent Goujon
> Assignee: Laurent Goujon
> Priority: Major
>
> According to CVE-2020-8908, method Files#createTempDir has some security
> issues, and usage has been deprecated in Guava 30.0.
> Usage of this function in Drill should be replaced with the native Java
> version as recommended by the Guava team.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
