HBASE-26903 Bump httpclient from 4.5.3 to 4.5.13 #4296

apurtell · 2022-03-29T17:14:14Z

Dependabot auto-generated a dependency upgrade (#4291) but we could not merge that PR as-is because it caused a unit test failure. There is a comment in our POM indicating this is a known issue:

<!-- Updating the httpclient will break hbase-rest. It writes out URLs with '//' in it                                                                                          
  especially when writing out 'no column families'. Later httpclients collapse the '//'                                                                                         
  into single '/' as double-slash is not legal in an URL. Breaks #testDelete in                                                                                                 
  TestRemoteTable. -->

However, staying back on a version of httpclient with CVE listed vulnerabilities just for this isn't a good option.

This change bumps httpclient from 4.5.3 to 4.5.13 to avoid a CVE of medium severity in this dependency.

Newer httpclient versions enable a URI normalization algorithm by default that rewrites URIs in a way that breaks some forms of valid REST gateway interactions, so this change also disables the unwanted behavior when building the httpclient instance in Client.

Bump httpclient from 4.5.3 to 4.5.13 to avoid a CVE of medium severity in this dependency. Newer httpclient versions enable a URI normalization algorithm by default that rewrites URIs in a way that breaks some forms of valid REST gateway interactions, so disable it when building the httpclient instance in Client.

Apache-HBase · 2022-03-29T18:35:04Z

🎊 +1 overall

Vote	Subsystem	Runtime	Comment
+0 🆗	reexec	1m 14s	Docker mode activated.
		_ Prechecks _
+1 💚	dupname	0m 0s	No case conflicting files found.
+1 💚	hbaseanti	0m 0s	Patch does not have any anti-patterns.
+1 💚	@author	0m 0s	The patch does not contain any @author tags.
		_ master Compile Tests _
+0 🆗	mvndep	0m 18s	Maven dependency ordering for branch
+1 💚	mvninstall	2m 24s	master passed
+1 💚	compile	6m 18s	master passed
+1 💚	checkstyle	1m 11s	master passed
+1 💚	spotbugs	7m 46s	master passed
		_ Patch Compile Tests _
+0 🆗	mvndep	0m 15s	Maven dependency ordering for patch
+1 💚	mvninstall	2m 18s	the patch passed
+1 💚	compile	6m 10s	the patch passed
+1 💚	javac	6m 10s	the patch passed
+1 💚	checkstyle	1m 9s	root: The patch generated 0 new + 28 unchanged - 1 fixed = 28 total (was 29)
+1 💚	whitespace	0m 0s	The patch has no whitespace issues.
+1 💚	xml	0m 0s	The patch has no ill-formed XML file.
+1 💚	hadoopcheck	12m 3s	Patch does not cause any errors with Hadoop 3.1.2 3.2.2 3.3.1.
+1 💚	spotbugs	7m 52s	the patch passed
		_ Other Tests _
+1 💚	asflicense	0m 21s	The patch does not generate ASF License warnings.
		54m 48s

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4296/1/artifact/yetus-general-check/output/Dockerfile
GITHUB PR	#4296
Optional Tests	dupname asflicense javac spotbugs hadoopcheck hbaseanti checkstyle compile xml
uname	Linux 15f4dc56ffb1 5.4.0-90-generic #101-Ubuntu SMP Fri Oct 15 20:00:55 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/hbase-personality.sh
git revision	master / `7adccd2`
Default Java	AdoptOpenJDK-1.8.0_282-b08
Max. process+thread count	139 (vs. ulimit of 30000)
modules	C: hbase-rest . U: .
Console output	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4296/1/console
versions	git=2.17.1 maven=3.6.3 spotbugs=4.2.2
Powered by	Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

Apache-HBase · 2022-03-29T22:18:25Z

🎊 +1 overall

Vote	Subsystem	Runtime	Comment
+0 🆗	reexec	0m 47s	Docker mode activated.
-0 ⚠️	yetus	0m 3s	Unprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
		_ Prechecks _
		_ master Compile Tests _
+0 🆗	mvndep	0m 27s	Maven dependency ordering for branch
+1 💚	mvninstall	4m 4s	master passed
+1 💚	compile	2m 48s	master passed
+1 💚	shadedjars	5m 40s	branch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	3m 30s	master passed
		_ Patch Compile Tests _
+0 🆗	mvndep	0m 22s	Maven dependency ordering for patch
+1 💚	mvninstall	4m 18s	the patch passed
+1 💚	compile	2m 48s	the patch passed
+1 💚	javac	2m 48s	the patch passed
+1 💚	shadedjars	4m 23s	patch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	2m 7s	the patch passed
		_ Other Tests _
+1 💚	unit	243m 49s	root in the patch passed.
		278m 7s

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4296/1/artifact/yetus-jdk11-hadoop3-check/output/Dockerfile
GITHUB PR	#4296
Optional Tests	javac javadoc unit shadedjars compile
uname	Linux b2fd1e4335c4 5.4.0-90-generic #101-Ubuntu SMP Fri Oct 15 20:00:55 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/hbase-personality.sh
git revision	master / `7adccd2`
Default Java	AdoptOpenJDK-11.0.10+9
Test Results	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4296/1/testReport/
Max. process+thread count	4749 (vs. ulimit of 30000)
modules	C: hbase-rest . U: .
Console output	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4296/1/console
versions	git=2.17.1 maven=3.6.3
Powered by	Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

Apache-HBase · 2022-03-30T00:50:42Z

💔 -1 overall

Vote	Subsystem	Runtime	Comment
+0 🆗	reexec	1m 16s	Docker mode activated.
-0 ⚠️	yetus	0m 4s	Unprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
		_ Prechecks _
		_ master Compile Tests _
+0 🆗	mvndep	0m 30s	Maven dependency ordering for branch
+1 💚	mvninstall	3m 18s	master passed
+1 💚	compile	2m 2s	master passed
+1 💚	shadedjars	5m 7s	branch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	2m 7s	master passed
		_ Patch Compile Tests _
+0 🆗	mvndep	0m 16s	Maven dependency ordering for patch
+1 💚	mvninstall	2m 47s	the patch passed
+1 💚	compile	1m 56s	the patch passed
+1 💚	javac	1m 56s	the patch passed
+1 💚	shadedjars	4m 54s	patch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	2m 7s	the patch passed
		_ Other Tests _
-1 ❌	unit	400m 6s	root in the patch failed.
		429m 56s

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4296/1/artifact/yetus-jdk8-hadoop3-check/output/Dockerfile
GITHUB PR	#4296
Optional Tests	javac javadoc unit shadedjars compile
uname	Linux bb0186ba2b97 5.4.0-1025-aws #25~18.04.1-Ubuntu SMP Fri Sep 11 12:03:04 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/hbase-personality.sh
git revision	master / `7adccd2`
Default Java	AdoptOpenJDK-1.8.0_282-b08
unit	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4296/1/artifact/yetus-jdk8-hadoop3-check/output/patch-unit-root.txt
Test Results	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4296/1/testReport/
Max. process+thread count	2417 (vs. ulimit of 30000)
modules	C: hbase-rest . U: .
Console output	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4296/1/console
versions	git=2.17.1 maven=3.6.3
Powered by	Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

Bump httpclient from 4.5.3 to 4.5.13 to avoid a CVE of medium severity in this dependency. Newer httpclient versions enable a URI normalization algorithm by default that rewrites URIs in a way that breaks some forms of valid REST gateway interactions, so disable it when building the httpclient instance in Client. Signed-off-by: Duo Zhang <zhangduo@apache.org> Signed-off-by: Pankaj Kumar <pankajkumar@apache.org>

Bump httpclient from 4.5.3 to 4.5.13 to avoid a CVE of medium severity in this dependency. Newer httpclient versions enable a URI normalization algorithm by default that rewrites URIs in a way that breaks some forms of valid REST gateway interactions, so disable it when building the httpclient instance in Client. Signed-off-by: Duo Zhang <zhangduo@apache.org> Signed-off-by: Pankaj Kumar <pankajkumar@apache.org> Conflicts: pom.xml

Bump httpclient from 4.5.3 to 4.5.13 to avoid a CVE of medium severity in this dependency. Newer httpclient versions enable a URI normalization algorithm by default that rewrites URIs in a way that breaks some forms of valid REST gateway interactions, so disable it when building the httpclient instance in Client. Signed-off-by: Duo Zhang <zhangduo@apache.org> Signed-off-by: Pankaj Kumar <pankajkumar@apache.org>

Bump httpclient from 4.5.3 to 4.5.13 to avoid a CVE of medium severity in this dependency. Newer httpclient versions enable a URI normalization algorithm by default that rewrites URIs in a way that breaks some forms of valid REST gateway interactions, so disable it when building the httpclient instance in Client. Signed-off-by: Duo Zhang <zhangduo@apache.org> Signed-off-by: Pankaj Kumar <pankajkumar@apache.org> Conflicts: pom.xml (cherry picked from commit 55bc977) Change-Id: I2fdadb335ae7589841208598b947b954e3aa87a2

apurtell requested review from Apache9 and ndimiduk March 29, 2022 17:21

Apache9 approved these changes Mar 30, 2022

View reviewed changes

pankaj72981 approved these changes Mar 30, 2022

View reviewed changes

apurtell merged commit b3c3e2f into apache:master Mar 30, 2022

apurtell deleted the HBASE-26903 branch March 30, 2022 21:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

HBASE-26903 Bump httpclient from 4.5.3 to 4.5.13 #4296

HBASE-26903 Bump httpclient from 4.5.3 to 4.5.13 #4296

apurtell commented Mar 29, 2022

Apache-HBase commented Mar 29, 2022

Apache-HBase commented Mar 29, 2022

Apache-HBase commented Mar 30, 2022

HBASE-26903 Bump httpclient from 4.5.3 to 4.5.13 #4296

HBASE-26903 Bump httpclient from 4.5.3 to 4.5.13 #4296

Conversation

apurtell commented Mar 29, 2022

Apache-HBase commented Mar 29, 2022

Apache-HBase commented Mar 29, 2022

Apache-HBase commented Mar 30, 2022