-
Notifications
You must be signed in to change notification settings - Fork 25
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Fix] Fix vulnerabilities in the present SDK version (#383)
## What changes are proposed in this pull request? - **What** : - Update commons.io to fix the [CVE in the present version](https://mvnrepository.com/artifact/com.databricks/databricks-sdk-java/0.34.0). Looks like depandabot PRs are no longer being created/merged. [[Link](https://github.com/databricks/databricks-sdk-java/pull/261/files)] - Change ini4j configuration because of vulnerability. - **Why** - ini4j 0.5.4 version has an infinite loop situation in the following piece of code. This loop can cause excessive memory and CPU usage, potentially crashing the application. Alternate libraries like Apache Commons Configuration gracefully handle the situation (by limiting the recursions internally). I will raise a PR on SDK later today to replace the ini4j library. Moreover : the official site of ini4j [is up for sale](http://www.ini4j.org/) and the last update to this maven package was done in [2015](https://mvnrepository.com/artifact/org.ini4j/ini4j). There is no reason we should continue to use this package. ``` Ini ini = new Ini(); ini.load(new ByteArrayInputStream(""" [deploy] a = ${test/a} b = ${doc/b} [test] a = ${deploy/a} b = ${deploy/b} [doc] a = 15 b = 45 """.getBytes(StandardCharsets.UTF_8))); // Will cause stack overflow ini.get("deploy").fetch("a"); ``` ## How is this tested? - The existing unit tests run fine.
- Loading branch information
1 parent
5deef7d
commit 849cd3d
Showing
2 changed files
with
25 additions
and
24 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters