Merge branch 'cassandra-4.1' into cassandra-5.0

* cassandra-4.1:
  Autogenerate toplevel .snyk file from owasp suppressions

.build/build-owasp.xml

@@ -112,4 +112,7 @@
         <antcall target="-run-owasp-scan" inheritrefs="true" inheritall="true"/>
     </target>
 
+    <target name="generate-snyk-file" unless="ant.gen-snyk.skip">
+        <exec executable="python3" failonerror="true"><arg value="${basedir}/.build/generate-snyk-file"/></exec>
+    </target>
 </project>

.build/build-rat.xml

@@ -42,6 +42,7 @@
             <fileset dir="." includesfile="${build.dir}/.ratinclude">
                  <!-- Config files with not much creativity -->
                  <exclude name=".asf.yaml"/>
+                 <exclude name=".snyk"/>
                  <exclude name="**/cassandra*.yaml"/>
                  <exclude NAME="doc/antora.yml"/>
                  <exclude name="ide/**/*"/>

.build/generate-snyk-file

@@ -0,0 +1,75 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""
+Regenerates the toplevel .snyk file from the dependency-check-suppressions.xml found in this directory.
+"""
+
+import re
+import os
+
+
+script_dir = os.path.dirname(os.path.abspath(__file__))
+with open(os.path.join(script_dir, "owasp/dependency-check-suppressions.xml"), "r", encoding="utf-8") as f:
+    xml_lines = [line.strip() for line in f.readlines()]
+
+snyk_data = {"ignore": {}}
+
+# Parse XML (keeping track of comments)
+last_comment = None
+i = 0
+while i < len(xml_lines):
+    # Detect XML comments (these contain the suppression reason)
+    if xml_lines[i].startswith("<!--") and xml_lines[i].endswith("-->"):
+        last_comment = xml_lines[i][4:-3].strip()
+
+    # Collect CVE suppressions
+    if "<suppress>" in xml_lines[i]:
+        cve_ids = []
+        packages = ''
+        i += 1
+        while i < len(xml_lines):
+            if xml_lines[i].startswith("<!--") and xml_lines[i].endswith("-->"):
+                last_comment = xml_lines[i][4:-3].strip() 
+            if "<cve>" in xml_lines[i] and "</cve>" in xml_lines[i]:
+                cve_ids.append(xml_lines[i].strip().replace("<cve>", "").replace("</cve>", "").strip())
+            if "<packageUrl" in xml_lines[i] and "</packageUrl>" in xml_lines[i]:
+                packages = re.sub(r'<packageUrl(?: regex="(?:true|false)")?>|</packageUrl>', '', xml_lines[i]).strip()
+            if "</suppress>" in xml_lines[i]:
+                break
+            i += 1
+        reason = f"{last_comment} -- {packages}" if last_comment else "Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml"
+
+        # Add suppressions
+        for cve_id in cve_ids:
+            snyk_data["ignore"][cve_id] = [{"reason": reason}]
+
+        last_comment = None
+    else:
+        i += 1
+
+with open(os.path.join(script_dir, "../.snyk"), "w") as snyk_file:
+    snyk_file.write("# Snyk (https://snyk.io) policy file, provides ignores for known false positives.\n")
+    snyk_file.write("# This file is autogenerated from .build/dependency-check-suppressions.xml\n")
+    snyk_file.write("version: v1.25.0\n")
+    snyk_file.write(f"ignore:\n")
+    for cve_id, ignores in snyk_data["ignore"].items():
+        snyk_file.write(f"  {cve_id}:\n")
+        for ignore in ignores:
+            snyk_file.write(f"    - reason: {ignore['reason']}\n")
+

.snyk

@@ -0,0 +1,32 @@
+# Snyk (https://snyk.io) policy file, provides ignores for known false positives.
+# This file is autogenerated from .build/dependency-check-suppressions.xml
+version: v1.25.0
+ignore:
+  CVE-2022-1471:
+    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
+  CVE-2022-25857:
+    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
+  CVE-2022-38749:
+    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
+  CVE-2022-38750:
+    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
+  CVE-2022-38751:
+    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
+  CVE-2022-38752:
+    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
+  CVE-2022-41854:
+    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
+  CVE-2023-44487:
+    - reason: https://issues.apache.org/jira/browse/CASSANDRA-18943 -- ^pkg:maven/io\.netty/netty\-.*@.*$
+  CVE-2022-42003:
+    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17966 -- ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$
+  CVE-2022-42004:
+    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17966 -- ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$
+  CVE-2023-35116:
+    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17966 -- ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$
+  CVE-2023-6378:
+    - reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
+  CVE-2023-6481:
+    - reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
+  CVE-2024-45772:
+    - reason: https://issues.apache.org/jira/browse/CASSANDRA-20024 -- ^pkg:maven/org\.apache\.lucene/lucene\-.*@9.7.0$

CHANGES.txt

@@ -22,6 +22,7 @@ Merged from 4.1:
  * Fix SimpleClient ability to release acquired capacity (CASSANDRA-20202)
  * Fix WaitQueue.Signal.awaitUninterruptibly may block forever if invoking thread is interrupted (CASSANDRA-20084)
 Merged from 4.0:
+ * Include in source tree and build packages a Snyk policy file that lists known false positives (CASSANDRA-20319)
  * Update zstd-jni to 1.5.7-2 (CASSANDRA-20453)
  * Suppress CVE-2024-12801 (CASSANDRA-20412)
  * Suppress CVE-2024-12798 (CASSANDRA-20408)

build.xml

@@ -536,7 +536,7 @@
         </javac>
     </target>
 
-    <target depends="init,gen-cql3-grammar,generate-cql-html,generate-jflex-java"
+    <target depends="init,gen-cql3-grammar,generate-cql-html,generate-jflex-java,generate-snyk-file"
             name="build-project">
         <echo message="${ant.project.name}: ${ant.file}"/>
         <!-- Order matters! -->
@@ -891,6 +891,7 @@
       <copy todir="${dist.dir}/">
         <fileset dir="${basedir}">
           <include name="*.txt" />
+          <include name=".snyk" />
         </fileset>
       </copy>
       <copy todir="${dist.dir}/tools/bin">

debian/rules

@@ -78,7 +78,7 @@ binary-indep: build install
 	dh_testroot
 	dh_installchangelogs
 	dh_installinit -u'start 50 2 3 4 5 . stop 50 0 1 6 .'
-	dh_installdocs README.asc CHANGES.txt NEWS.txt doc/cql3/CQL.css doc/cql3/CQL.html CASSANDRA-14092.txt
+	dh_installdocs README.asc CHANGES.txt NEWS.txt doc/cql3/CQL.css doc/cql3/CQL.html CASSANDRA-14092.txt .snyk
 	dh_installexamples tools/*.yaml
 	dh_bash-completion
 	dh_compress

redhat/cassandra.spec

@@ -140,7 +140,7 @@ exit 0
 
 %files
 %defattr(0644,root,root,0755)
-%doc CHANGES.txt LICENSE.txt README.asc NEWS.txt NOTICE.txt CASSANDRA-14092.txt
+%doc CHANGES.txt LICENSE.txt README.asc NEWS.txt NOTICE.txt CASSANDRA-14092.txt .snyk
 %attr(755,root,root) %{_bindir}/auditlogviewer
 %attr(755,root,root) %{_bindir}/jmxtool
 %attr(755,root,root) %{_bindir}/cassandra-stress

redhat/noboolean/cassandra.spec

@@ -143,7 +143,7 @@ exit 0
 
 %files
 %defattr(0644,root,root,0755)
-%doc CHANGES.txt LICENSE.txt README.asc NEWS.txt NOTICE.txt CASSANDRA-14092.txt
+%doc CHANGES.txt LICENSE.txt README.asc NEWS.txt NOTICE.txt CASSANDRA-14092.txt .snyk
 %attr(755,root,root) %{_bindir}/auditlogviewer
 %attr(755,root,root) %{_bindir}/jmxtool
 %attr(755,root,root) %{_bindir}/cassandra-stress