Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade guava version to 31.1-jre #14767

Merged
merged 8 commits into from
Aug 22, 2023

Conversation

tejaswini-imply
Copy link
Member

Currently, Druid is using Guava 16.0.1 version. This upgrade to 31.1-jre fixes the following issues.

  • CVE-2018-10237 (Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable). We don't use Java or GWT serializations. Despite being false positive they're causing red security scans on Druid distribution.
  • Latest version of google-client-api is incompatible with the existing Guava version. This PR unblocks Update google client apis to latest version #14414

.idea/scopes/JavaInspectionsScope.xml Outdated Show resolved Hide resolved
licenses.yaml Outdated
license_category: binary
module: java-core
license_name: Apache License version 2.0
version: 9999.0-empty-to-avoid-conflict-with-guava
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why is this change required?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Apparently this is a transitive dependency of com.google.guava:guava:31.1-jre. Although this is an empty artifactory I am not entirely sure of repurcusions of removing this dependency.

@@ -48,6 +48,7 @@

/**
*/
@SuppressWarnings("CheckReturnValue")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why this change was needed?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This line is causing this warning during strict compilation check.

Although this line is in unused tests and can be removed, thought by suppressing the check won't disturb any existing logic check that I'm not aware of.

@@ -265,7 +265,7 @@ public void testPollPeriodicallyAndOnDemandInterleave() throws Exception
Assert.assertTrue(sqlSegmentsMetadataManager.getLatestDatabasePoll() instanceof SqlSegmentsMetadataManager.PeriodicDatabasePoll);
dataSourcesSnapshot = sqlSegmentsMetadataManager.getDataSourcesSnapshot();
Assert.assertEquals(
ImmutableList.of("wikipedia2", "wikipedia3", "wikipedia"),
ImmutableList.of("wikipedia3", "wikipedia", "wikipedia2"),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why does this order change?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes to this method com.google.common.collect.Maps.newHashMapWithExpectedSize(int expectedSize) which we're calling from here

final Map<K, V2> result = Maps.newHashMapWithExpectedSize(map.size());
caused this order to change

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks like the order changed again in https://github.com/apache/druid/pull/15482/files#r1414283468. Given that we are not order sensitive it might make more sense to compare sets.

Copy link
Contributor

@capistrant capistrant left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is looking great! I agree with the changes to use latest guava api by passing in direct executor in many places where the legacy method args are no longer supported. I share questions with @abhishekagarwal87 about a lot of the changes to annotations and seemingly trivial changes other places that aren't clearly a part of this specific change. I'd prefer we keep this PR to just the base set of changes for guava itself and push any other fixups in another PR if possible! But overall, this is a very cool PR to finally see come upstream!

@@ -236,7 +236,7 @@ public void poll()
{
try {

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this required for this change?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This ImmutableMap.copyOf(Map<? extends K, ? extends V> map) is now overloaded with another method ImmutableMap.copyOf(Iterable<? extends Entry<? extends K, ? extends V>> entries). Compiler was complaining when I tried to cast the params to Map<String, List<Rule>> hence created another variable with that type and used it to obtain ImmutableMap.

@abhishekagarwal87 abhishekagarwal87 merged commit d87056e into apache:master Aug 22, 2023
68 of 71 checks passed
@LakshSingla LakshSingla added this to the 28.0 milestone Oct 12, 2023
xvrl added a commit to xvrl/druid that referenced this pull request Dec 5, 2023
Several dependabot ignore directives are no longer relevant. Unpin them
to ensure we get again get timely updates via dependabot.

* support for Hadoop 2 was dropped as part of apache#14763
* Guava was upgraded to 31 as part of apache#14767
* Calcite was upgraded to 1.35 as part of apache#14510
xvrl added a commit to xvrl/druid that referenced this pull request Dec 5, 2023
Several dependabot ignore directives are no longer relevant. Unpin them
to ensure we get again get timely updates via dependabot.

* support for Hadoop 2 was dropped as part of apache#14763
* Guava was upgraded to 31 as part of apache#14767
* Calcite was upgraded to 1.35 as part of apache#14510
xvrl added a commit that referenced this pull request Dec 6, 2023
Several dependabot ignore directives are no longer relevant. Unpin them
to ensure we get again get timely updates via dependabot.

* support for Hadoop 2 was dropped as part of #14763
* Guava was upgraded to 31 as part of #14767
* Calcite was upgraded to 1.35 as part of #14510
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants