Skip to content

Making jackson-dataformat-yaml an optional/provided dependency#25350

Closed
pabloem wants to merge 1 commit intoapache:masterfrom
pabloem:optional-yaml
Closed

Making jackson-dataformat-yaml an optional/provided dependency#25350
pabloem wants to merge 1 commit intoapache:masterfrom
pabloem:optional-yaml

Conversation

@pabloem
Copy link
Copy Markdown
Member

@pabloem pabloem commented Feb 6, 2023

Please add a meaningful description for your change here


Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily:

  • Mention the appropriate issue in your description (for example: addresses #123), if applicable. This will automatically add a link to the pull request in the issue. If you would like the issue to automatically close on merging the pull request, comment fixes #<ISSUE NUMBER> instead.
  • Update CHANGES.md with noteworthy changes.
  • If this contribution is large, please file an Apache Individual Contributor License Agreement.

See the Contributor Guide for more tips on how to make review process smoother.

To check the build health, please visit https://github.com/apache/beam/blob/master/.test-infra/BUILD_STATUS.md

GitHub Actions Tests Status (on master branch)

Build python source distribution and wheels
Python tests
Java tests
Go tests

See CI.md for more information about GitHub Actions CI.

@github-actions github-actions bot added the java label Feb 6, 2023
@pabloem
Copy link
Copy Markdown
Member Author

pabloem commented Feb 6, 2023

r: @chamikaramj

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Feb 6, 2023

Stopping reviewer notifications for this pull request: review requested by someone other than the bot, ceding control

@chamikaramj
Copy link
Copy Markdown
Contributor

LGTM.

@chamikaramj
Copy link
Copy Markdown
Contributor

chamikaramj commented Feb 6, 2023

- LGTM

This actually will break a documented feature - https://beam.apache.org/documentation/programming-guide/#1311-creating-cross-language-java-transforms

Also, seems like the vulnerability related to this library is a false positive for our use-case.

This might also result in runtime issues for multi-lang users in general since these classes might get loaded during execution (depends on the how the code is structured).

@chamikaramj
Copy link
Copy Markdown
Contributor

How do we parse YAML elsewhere in the code base or in other project ?

At least, we should make sure that users that do not use a allowlist do not run into class loading errors due to the dependency not being available in the shaded expansion service jars.

Also, if we exclude the dependency, we should update the documentation to mention that the dependency should be explicitly included when using an allowlist.

@pabloem
Copy link
Copy Markdown
Member Author

pabloem commented Feb 13, 2023

Closing as the underlying CVE is not exploitable for Beam. See: #25449

@pabloem pabloem closed this Feb 13, 2023
@pabloem pabloem deleted the optional-yaml branch February 13, 2023 22:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants