-
Notifications
You must be signed in to change notification settings - Fork 424
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
TEZ-4435: use jackson v2 - jackson v1 is EOL and full of security issues #231
Conversation
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Seems similar stuff was done in Hadoop as well.
We should restrict these imports as well so as to avoid future usage by others.
Something like this
https://github.com/apache/hadoop/pull/3789/files#diff-9c5fb3d1b7e3b0f54bc5c4182965c4fe1f9023d449017cece3005d3f90e8e4d8R276-R283
@ayushtkn I've never used that plugin before. I checked its docs and the docs don't match what Hadoop has. In https://github.com/skuzzle/restrict-imports-enforcer-rule - the XML element is called 'RestrictImports' but Hadoop pom.xml has 'restrictImports'. I tried both on my Tez checkout and so far, the rule is not enforced either way. |
@ayushtkn looks like Hadoop is wrong according to the plugin's release notes - https://github.com/skuzzle/restrict-imports-enforcer-rule/blob/4e939bfa9f8a048b367bd7b2ab9b79b5a87068b0/RELEASE_NOTES.md |
@ayushtkn I think I have the enforcement rule working now - the inherited=false flag seems to have stopped the rule being enforced in sub-modules. The 'restrictImports' XML tag seems to work despite the docs in https://github.com/skuzzle/restrict-imports-enforcer-rule |
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
💔 -1 overall
This message was automatically generated. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
@abstractdog can you help push this further
@abstractdog @ayushtkn would it be possible to get this merged? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM +1
checked locally and enforcer rule works
https://issues.apache.org/jira/browse/TEZ-4435