Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(sec): upgrade org.apache.jena:jena-arq to 4.2.0 #4507

Merged
merged 1 commit into from
Sep 5, 2024

Conversation

645775992
Copy link
Contributor

What happened?

There are 1 security vulnerabilities found in org.apache.jena:jena-arq 3.12.0

What did I do?

Upgrade org.apache.jena:jena-arq from 3.12.0 to 4.2.0 for vulnerability fix

What did you expect to happen?

Ideally, no insecure libs should be used.

The specification of the pull request

PR Specification from OSCS

@pjfanning
Copy link
Contributor

@jongyoul could this be merged?

@jongyoul jongyoul merged commit 950fe0b into apache:master Sep 5, 2024
@Reamer
Copy link
Contributor

Reamer commented Sep 5, 2024

@jongyoul org.apache.jena:jena-arq requires jdk 11.
Currently Zeppelin is build with jdk8, so we get build errors https://github.com/apache/zeppelin/actions/runs/10712570211/job/29703189803

This change also requires some adjustments in our codebase.

diff --git a/sparql/src/main/java/org/apache/zeppelin/sparql/JenaInterpreter.java b/sparql/src/main/java/org/apache/zeppelin/sparql/JenaInterpreter.java
index 9faf86908..3a3be3be7 100644
--- a/sparql/src/main/java/org/apache/zeppelin/sparql/JenaInterpreter.java
+++ b/sparql/src/main/java/org/apache/zeppelin/sparql/JenaInterpreter.java
@@ -57,7 +57,7 @@ public class JenaInterpreter implements SparqlEngine {
 
   @Override
   public InterpreterResult query(String query) {
-    LOGGER.info("SPARQL: Run Query '" + query + "' against " + serviceEndpoint);
+    LOGGER.info("SPARQL: Run Query '{}' against {}", query, serviceEndpoint);
 
     try {
       queryExecution = QueryExecutionFactory.sparqlService(serviceEndpoint, query);
@@ -92,7 +92,7 @@ public class JenaInterpreter implements SparqlEngine {
         "Error: " + e.getMessage());
     } catch (QueryExceptionHTTP e) {
       LOGGER.error(e.toString());
-      int responseCode = e.getResponseCode();
+      int responseCode = e.getStatusCode();
 
       if (responseCode == HttpStatus.SC_UNAUTHORIZED) {
         return new InterpreterResult(
diff --git a/sparql/src/test/java/org/apache/zeppelin/sparql/SparqlJenaEngineTest.java b/sparql/src/test/java/org/apache/zeppelin/sparql/SparqlJenaEngineTest.java
index 84195bbcf..548880437 100644
--- a/sparql/src/test/java/org/apache/zeppelin/sparql/SparqlJenaEngineTest.java
+++ b/sparql/src/test/java/org/apache/zeppelin/sparql/SparqlJenaEngineTest.java
@@ -17,9 +17,11 @@
 
 package org.apache.zeppelin.sparql;
 
+import org.apache.jena.atlas.web.WebLib;
 import org.apache.jena.fuseki.Fuseki;
 import org.apache.jena.fuseki.main.FusekiServer;
 import org.apache.jena.fuseki.server.DataAccessPointRegistry;
+import org.apache.jena.fuseki.system.FusekiNetLib;
 import org.apache.jena.query.Dataset;
 import org.apache.jena.query.DatasetFactory;
 import org.apache.jena.rdf.model.Model;
@@ -52,7 +54,8 @@ class SparqlJenaEngineTest {
 
   @BeforeAll
   public static void setUp() {
-    port = Fuseki.choosePort();
+
+    port = WebLib.choosePort();
 
     Model model = ModelFactory.createDefaultModel();
     model.read(DATA_FILE);

EDIT: I will revert the change so that Zeppelin build is stable, we can pick up the change again when we finally switch to JDK 11+.

Reamer added a commit that referenced this pull request Sep 5, 2024
Reamer added a commit to Reamer/zeppelin that referenced this pull request Sep 5, 2024
jongyoul pushed a commit that referenced this pull request Sep 8, 2024
@Reamer
Copy link
Contributor

Reamer commented Sep 9, 2024

I have created the following task so that this update is not forgotten. https://issues.apache.org/jira/browse/ZEPPELIN-6084

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants