Commit 849cd3d
authored
[Fix] Fix vulnerabilities in the present SDK version (#383)
## What changes are proposed in this pull request?
- **What** :
- Update commons.io to fix the [CVE in the present
version](https://mvnrepository.com/artifact/com.databricks/databricks-sdk-java/0.34.0).
Looks like depandabot PRs are no longer being created/merged.
[[Link](https://github.com/databricks/databricks-sdk-java/pull/261/files)]
- Change ini4j configuration because of vulnerability.
- **Why**
- ini4j 0.5.4 version has an infinite loop situation in the following
piece of code. This loop can cause excessive memory and CPU usage,
potentially crashing the application. Alternate libraries like Apache
Commons Configuration gracefully handle the situation (by limiting the
recursions internally). I will raise a PR on SDK later today to replace
the ini4j library. Moreover : the official site of ini4j [is up for
sale](http://www.ini4j.org/) and the last update to this maven package
was done in [2015](https://mvnrepository.com/artifact/org.ini4j/ini4j).
There is no reason we should continue to use this package.
```
Ini ini = new Ini();
ini.load(new ByteArrayInputStream("""
[deploy]
a = ${test/a}
b = ${doc/b}
[test]
a = ${deploy/a}
b = ${deploy/b}
[doc]
a = 15
b = 45
""".getBytes(StandardCharsets.UTF_8)));
// Will cause stack overflow
ini.get("deploy").fetch("a");
```
## How is this tested?
- The existing unit tests run fine.1 parent 5deef7d commit 849cd3d
File tree
2 files changed
+25
-24
lines changed- databricks-sdk-java
- src/main/java/com/databricks/sdk/core
2 files changed
+25
-24
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
49 | 49 | | |
50 | 50 | | |
51 | 51 | | |
52 | | - | |
53 | | - | |
54 | | - | |
| 52 | + | |
| 53 | + | |
| 54 | + | |
55 | 55 | | |
56 | 56 | | |
57 | 57 | | |
| |||
67 | 67 | | |
68 | 68 | | |
69 | 69 | | |
70 | | - | |
| 70 | + | |
71 | 71 | | |
72 | 72 | | |
73 | 73 | | |
| |||
Lines changed: 21 additions & 20 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | 1 | | |
2 | 2 | | |
3 | 3 | | |
4 | | - | |
5 | 4 | | |
| 5 | + | |
6 | 6 | | |
7 | 7 | | |
8 | 8 | | |
9 | 9 | | |
10 | 10 | | |
11 | 11 | | |
12 | | - | |
13 | | - | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
14 | 15 | | |
15 | 16 | | |
16 | 17 | | |
| |||
40 | 41 | | |
41 | 42 | | |
42 | 43 | | |
43 | | - | |
| 44 | + | |
44 | 45 | | |
45 | 46 | | |
46 | 47 | | |
| |||
57 | 58 | | |
58 | 59 | | |
59 | 60 | | |
60 | | - | |
| 61 | + | |
61 | 62 | | |
62 | 63 | | |
63 | 64 | | |
| |||
86 | 87 | | |
87 | 88 | | |
88 | 89 | | |
89 | | - | |
| 90 | + | |
90 | 91 | | |
| 92 | + | |
91 | 93 | | |
92 | 94 | | |
93 | 95 | | |
94 | 96 | | |
95 | 97 | | |
96 | | - | |
97 | | - | |
98 | | - | |
| 98 | + | |
| 99 | + | |
| 100 | + | |
99 | 101 | | |
100 | 102 | | |
101 | 103 | | |
102 | | - | |
103 | | - | |
| 104 | + | |
104 | 105 | | |
105 | 106 | | |
106 | 107 | | |
107 | 108 | | |
108 | 109 | | |
109 | | - | |
| 110 | + | |
110 | 111 | | |
111 | 112 | | |
112 | 113 | | |
113 | 114 | | |
114 | 115 | | |
115 | 116 | | |
116 | 117 | | |
117 | | - | |
118 | | - | |
119 | | - | |
120 | | - | |
| 118 | + | |
| 119 | + | |
| 120 | + | |
| 121 | + | |
121 | 122 | | |
122 | 123 | | |
123 | 124 | | |
124 | 125 | | |
125 | | - | |
| 126 | + | |
126 | 127 | | |
127 | 128 | | |
128 | | - | |
| 129 | + | |
129 | 130 | | |
130 | 131 | | |
131 | 132 | | |
| |||
230 | 231 | | |
231 | 232 | | |
232 | 233 | | |
233 | | - | |
| 234 | + | |
234 | 235 | | |
235 | 236 | | |
236 | 237 | | |
237 | 238 | | |
238 | | - | |
| 239 | + | |
239 | 240 | | |
240 | 241 | | |
241 | 242 | | |
| |||
0 commit comments