Skip to content

guava fixes - #683

Open
AbhishekKumar9984 wants to merge 1 commit into
data-integrations:developfrom
cloudsufi:guava_fixes
Open

AbhishekKumar9984 wants to merge 1 commit into
data-integrations:developfrom
cloudsufi:guava_fixes

Conversation

@AbhishekKumar9984

Copy link
Copy Markdown

No description provided.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the Guava dependency version across multiple POM files to use the ${guava.version} property. The review feedback points out that specifying the version in the submodules is redundant due to parent dependency management. Additionally, the selected Guava version (32.0.0-jre) is vulnerable to CVE-2023-2976, and it is recommended to upgrade to a secure version like 32.1.3-jre and ensure consistency across all profiles.

Comment on lines +85 to +89
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>${guava.version}</version>
</dependency>

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The version of com.google.guava:guava is already managed in the parent POM's <dependencyManagement> section. Specifying the version here is redundant and can be safely removed to simplify dependency management.

    <dependency>
      <groupId>com.google.guava</groupId>
      <artifactId>guava</artifactId>
    </dependency>

Comment on lines 85 to 89
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>31.0.1-jre</version>
<version>${guava.version}</version>
</dependency>

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The version of com.google.guava:guava is already managed in the parent POM's <dependencyManagement> section. Specifying the version here is redundant and can be safely removed to simplify dependency management.

    <dependency>
      <groupId>com.google.guava</groupId>
      <artifactId>guava</artifactId>
    </dependency>

Comment thread pom.xml
<cdap.version>6.11.0</cdap.version>
<cdap.plugin.version>2.13.1</cdap.plugin.version>
<guava.version>13.0.1</guava.version>
<guava.version>32.0.0-jre</guava.version>

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

Guava version 32.0.0-jre is vulnerable to CVE-2023-2976 (local information disclosure via default temporary directory). It is highly recommended to use a secure version such as 32.1.3-jre (or at least 32.0.1-jre) to mitigate this vulnerability.

Suggested change
<guava.version>32.0.0-jre</guava.version>
<guava.version>32.1.3-jre</guava.version>

Comment thread pom.xml
<testSourceLocation>src/e2e-test/java</testSourceLocation>
<TEST_RUNNER>TestRunner.java</TEST_RUNNER>
<guava.version>32.1.2-jre</guava.version>
<guava.version>32.0.0-jre</guava.version>

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

To maintain consistency and avoid using a vulnerable version of Guava, please align this version with the main guava.version property (e.g., 32.1.3-jre).

Suggested change
<guava.version>32.0.0-jre</guava.version>
<guava.version>32.1.3-jre</guava.version>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant