HDFS-16410. Fixing Insecure Xml parsing in OfflineEditsXmlLoader #3854

hotcodemacha · 2022-01-04T12:47:15Z

Description of PR

Fixing Insecure Xml parsing in OfflineEditsXmlLoader

JIRA: HDFS-16410

steveloughran

Makes sense. are there other places in the code with the same issue? If so it would probably be best to have something in hadoop-common so it could be done consistently everywhere.

hadoop-yetus · 2022-01-04T18:18:04Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 46s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 1s		No case conflicting files found.
+0 🆗	codespell	0m 0s		codespell was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+1 💚	mvninstall	33m 23s		trunk passed
+1 💚	compile	1m 31s		trunk passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚	compile	1m 20s		trunk passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
+1 💚	checkstyle	0m 56s		trunk passed
+1 💚	mvnsite	1m 28s		trunk passed
+1 💚	javadoc	1m 0s		trunk passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚	javadoc	1m 29s		trunk passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
+1 💚	spotbugs	3m 16s		trunk passed
+1 💚	shadedclient	22m 52s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+1 💚	mvninstall	1m 23s		the patch passed
+1 💚	compile	1m 20s		the patch passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚	javac	1m 20s		the patch passed
+1 💚	compile	1m 15s		the patch passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
+1 💚	javac	1m 15s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	checkstyle	0m 51s		the patch passed
+1 💚	mvnsite	1m 18s		the patch passed
+1 💚	javadoc	0m 52s		the patch passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚	javadoc	1m 25s		the patch passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
+1 💚	spotbugs	3m 14s		the patch passed
+1 💚	shadedclient	22m 27s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
+1 💚	unit	228m 44s		hadoop-hdfs in the patch passed.
+1 💚	asflicense	0m 42s		The patch does not generate ASF License warnings.
		329m 29s

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-3854/1/artifact/out/Dockerfile
GITHUB PR	#3854
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient spotbugs checkstyle codespell
uname	Linux 7fe2b4f4b2b8 4.15.0-156-generic #163-Ubuntu SMP Thu Aug 19 23:31:58 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / `2436f49`
Default Java	Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-3854/1/testReport/
Max. process+thread count	2942 (vs. ulimit of 5500)
modules	C: hadoop-hdfs-project/hadoop-hdfs U: hadoop-hdfs-project/hadoop-hdfs
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-3854/1/console
versions	git=2.25.1 maven=3.6.3 spotbugs=4.2.2
Powered by	Apache Yetus 0.14.0-SNAPSHOT https://yetus.apache.org

This message was automatically generated.

hotcodemacha · 2022-01-05T08:32:20Z

Makes sense. are there other places in the code with the same issue? If so it would probably be best to have something in hadoop-common so it could be done consistently everywhere.

Thanks for the review @steveloughran. I checked the complete codebase, didn't have this issue anywhere else. I think we can keep the changes in OfflineEditsXmlLoader.java.

steveloughran

+1

steveloughran · 2022-01-05T11:46:43Z

approved, once yetus is happy I will merge it in

hadoop-yetus · 2022-01-05T14:15:38Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 42s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 1s		codespell was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+1 💚	mvninstall	34m 47s		trunk passed
+1 💚	compile	1m 36s		trunk passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚	compile	1m 25s		trunk passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
+1 💚	checkstyle	1m 5s		trunk passed
+1 💚	mvnsite	1m 32s		trunk passed
+1 💚	javadoc	1m 5s		trunk passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚	javadoc	1m 37s		trunk passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
+1 💚	spotbugs	3m 34s		trunk passed
+1 💚	shadedclient	25m 37s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+1 💚	mvninstall	1m 22s		the patch passed
+1 💚	compile	1m 24s		the patch passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚	javac	1m 24s		the patch passed
+1 💚	compile	1m 20s		the patch passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
+1 💚	javac	1m 20s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	checkstyle	1m 0s		the patch passed
+1 💚	mvnsite	1m 21s		the patch passed
+1 💚	javadoc	0m 53s		the patch passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚	javadoc	1m 29s		the patch passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
+1 💚	spotbugs	3m 26s		the patch passed
+1 💚	shadedclient	25m 22s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
+1 💚	unit	232m 13s		hadoop-hdfs in the patch passed.
+1 💚	asflicense	0m 44s		The patch does not generate ASF License warnings.
		341m 11s

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-3854/2/artifact/out/Dockerfile
GITHUB PR	#3854
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient spotbugs checkstyle codespell
uname	Linux c3b9fe95a9dc 4.15.0-156-generic #163-Ubuntu SMP Thu Aug 19 23:31:58 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / `d9de11d`
Default Java	Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-3854/2/testReport/
Max. process+thread count	2987 (vs. ulimit of 5500)
modules	C: hadoop-hdfs-project/hadoop-hdfs U: hadoop-hdfs-project/hadoop-hdfs
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-3854/2/console
versions	git=2.25.1 maven=3.6.3 spotbugs=4.2.2
Powered by	Apache Yetus 0.14.0-SNAPSHOT https://yetus.apache.org

This message was automatically generated.

steveloughran · 2022-01-05T15:52:29Z

@sunchao you think this is needed in the 3.3.2 release?

Contributed by Ashutosh Gupta

sunchao · 2022-01-05T18:02:07Z

@steveloughran sure, I've cherry-picked it to branch-3.3 and branch-3.3.2

Contributed by Ashutosh Gupta (cherry picked from commit 43e5218)

Contributed by Ashutosh Gupta (cherry picked from commit 43e5218) (cherry picked from commit 3992ba5)

Contributed by Ashutosh Gupta (cherry picked from commit 43e5218)

Contributed by Ashutosh Gupta

HDFS-16410. Fixing Insecure Xml parsing in OfflineEditsXmlLoader

2436f49

steveloughran reviewed Jan 4, 2022

View reviewed changes

Merge branch 'apache:trunk' into HDFS-16410

d9de11d

hotcodemacha requested a review from steveloughran January 5, 2022 08:33

steveloughran approved these changes Jan 5, 2022

View reviewed changes

steveloughran merged commit 43e5218 into apache:trunk Jan 5, 2022

sunchao pushed a commit that referenced this pull request Jan 5, 2022

HDFS-16410. Insecure Xml parsing in OfflineEditsXmlLoader (#3854)

6b83fe4

Contributed by Ashutosh Gupta

sunchao pushed a commit that referenced this pull request Jan 5, 2022

HDFS-16410. Insecure Xml parsing in OfflineEditsXmlLoader (#3854)

6ea9906

Contributed by Ashutosh Gupta

aajisaka pushed a commit that referenced this pull request Jan 10, 2022

HDFS-16410. Insecure Xml parsing in OfflineEditsXmlLoader (#3854)

3992ba5

Contributed by Ashutosh Gupta (cherry picked from commit 43e5218)

aajisaka pushed a commit that referenced this pull request Jan 10, 2022

HDFS-16410. Insecure Xml parsing in OfflineEditsXmlLoader (#3854)

322750e

Contributed by Ashutosh Gupta (cherry picked from commit 43e5218) (cherry picked from commit 3992ba5)

aajisaka pushed a commit that referenced this pull request Jan 10, 2022

HDFS-16410. Insecure Xml parsing in OfflineEditsXmlLoader (#3854)

b567dcd

Contributed by Ashutosh Gupta (cherry picked from commit 43e5218)

HarshitGupta11 pushed a commit to HarshitGupta11/hadoop that referenced this pull request Nov 28, 2022

HDFS-16410. Insecure Xml parsing in OfflineEditsXmlLoader (apache#3854)

2039c5a

Contributed by Ashutosh Gupta

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

HDFS-16410. Fixing Insecure Xml parsing in OfflineEditsXmlLoader #3854

HDFS-16410. Fixing Insecure Xml parsing in OfflineEditsXmlLoader #3854

Uh oh!

hotcodemacha commented Jan 4, 2022

Uh oh!

steveloughran left a comment

Uh oh!

hadoop-yetus commented Jan 4, 2022

Uh oh!

hotcodemacha commented Jan 5, 2022

Uh oh!

steveloughran left a comment

Uh oh!

steveloughran commented Jan 5, 2022

Uh oh!

hadoop-yetus commented Jan 5, 2022

Uh oh!

steveloughran commented Jan 5, 2022

Uh oh!

sunchao commented Jan 5, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

HDFS-16410. Fixing Insecure Xml parsing in OfflineEditsXmlLoader #3854

HDFS-16410. Fixing Insecure Xml parsing in OfflineEditsXmlLoader #3854

Uh oh!

Conversation

hotcodemacha commented Jan 4, 2022

Description of PR

Uh oh!

steveloughran left a comment

Choose a reason for hiding this comment

Uh oh!

hadoop-yetus commented Jan 4, 2022

Uh oh!

hotcodemacha commented Jan 5, 2022

Uh oh!

steveloughran left a comment

Choose a reason for hiding this comment

Uh oh!

steveloughran commented Jan 5, 2022

Uh oh!

hadoop-yetus commented Jan 5, 2022

Uh oh!

steveloughran commented Jan 5, 2022

Uh oh!

sunchao commented Jan 5, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants