-
Notifications
You must be signed in to change notification settings - Fork 2.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(sec): upgrade org.apache.jena:jena-arq to 4.2.0 #4507
fix(sec): upgrade org.apache.jena:jena-arq to 4.2.0 #4507
Conversation
@jongyoul could this be merged? |
@jongyoul This change also requires some adjustments in our codebase. diff --git a/sparql/src/main/java/org/apache/zeppelin/sparql/JenaInterpreter.java b/sparql/src/main/java/org/apache/zeppelin/sparql/JenaInterpreter.java
index 9faf86908..3a3be3be7 100644
--- a/sparql/src/main/java/org/apache/zeppelin/sparql/JenaInterpreter.java
+++ b/sparql/src/main/java/org/apache/zeppelin/sparql/JenaInterpreter.java
@@ -57,7 +57,7 @@ public class JenaInterpreter implements SparqlEngine {
@Override
public InterpreterResult query(String query) {
- LOGGER.info("SPARQL: Run Query '" + query + "' against " + serviceEndpoint);
+ LOGGER.info("SPARQL: Run Query '{}' against {}", query, serviceEndpoint);
try {
queryExecution = QueryExecutionFactory.sparqlService(serviceEndpoint, query);
@@ -92,7 +92,7 @@ public class JenaInterpreter implements SparqlEngine {
"Error: " + e.getMessage());
} catch (QueryExceptionHTTP e) {
LOGGER.error(e.toString());
- int responseCode = e.getResponseCode();
+ int responseCode = e.getStatusCode();
if (responseCode == HttpStatus.SC_UNAUTHORIZED) {
return new InterpreterResult(
diff --git a/sparql/src/test/java/org/apache/zeppelin/sparql/SparqlJenaEngineTest.java b/sparql/src/test/java/org/apache/zeppelin/sparql/SparqlJenaEngineTest.java
index 84195bbcf..548880437 100644
--- a/sparql/src/test/java/org/apache/zeppelin/sparql/SparqlJenaEngineTest.java
+++ b/sparql/src/test/java/org/apache/zeppelin/sparql/SparqlJenaEngineTest.java
@@ -17,9 +17,11 @@
package org.apache.zeppelin.sparql;
+import org.apache.jena.atlas.web.WebLib;
import org.apache.jena.fuseki.Fuseki;
import org.apache.jena.fuseki.main.FusekiServer;
import org.apache.jena.fuseki.server.DataAccessPointRegistry;
+import org.apache.jena.fuseki.system.FusekiNetLib;
import org.apache.jena.query.Dataset;
import org.apache.jena.query.DatasetFactory;
import org.apache.jena.rdf.model.Model;
@@ -52,7 +54,8 @@ class SparqlJenaEngineTest {
@BeforeAll
public static void setUp() {
- port = Fuseki.choosePort();
+
+ port = WebLib.choosePort();
Model model = ModelFactory.createDefaultModel();
model.read(DATA_FILE); EDIT: I will revert the change so that Zeppelin build is stable, we can pick up the change again when we finally switch to JDK 11+. |
This reverts commit 950fe0b.
I have created the following task so that this update is not forgotten. https://issues.apache.org/jira/browse/ZEPPELIN-6084 |
What happened?
There are 1 security vulnerabilities found in org.apache.jena:jena-arq 3.12.0
What did I do?
Upgrade org.apache.jena:jena-arq from 3.12.0 to 4.2.0 for vulnerability fix
What did you expect to happen?
Ideally, no insecure libs should be used.
The specification of the pull request
PR Specification from OSCS