natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'cassandra-4.0' into cassandra-4.1 

* cassandra-4.0:
  ninja-fix – python2 compat on .build/generate-snyk-file
This commit is contained in:
Mick Semb Wever 2025-03-30 13:57:13 +02:00
parent ef3dc6491e e2a881959b
commit 5baedef1d0
No known key found for this signature in database
GPG Key ID: E91335D77E3E87CB
3 changed files with 31 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.build/build-owasp.xml
View File

@ -113,6 +113,7 @@
</target> </target>
<target name="generate-snyk-file" unless="ant.gen-snyk.skip"> <target name="generate-snyk-file" unless="ant.gen-snyk.skip">
<chmod file="${basedir}/.build/generate-snyk-file" perm="+x"/>
<exec executable="${basedir}/.build/generate-snyk-file" failonerror="true"/> <exec executable="${basedir}/.build/generate-snyk-file" failonerror="true"/>
</target> </target>
</project> </project>

12
.build/generate-snyk-file
View File

@ -25,7 +25,7 @@ import os
script_dir = os.path.dirname(os.path.abspath(__file__)) script_dir = os.path.dirname(os.path.abspath(__file__))
with open(os.path.join(script_dir, "dependency-check-suppressions.xml"), "r", encoding="utf-8") as f: with open(os.path.join(script_dir, "dependency-check-suppressions.xml"), "r") as f:
xml_lines = [line.strip() for line in f.readlines()] xml_lines = [line.strip() for line in f.readlines()]
snyk_data = {"ignore": {}} snyk_data = {"ignore": {}}
@ -53,7 +53,7 @@ while i < len(xml_lines):
if "</suppress>" in xml_lines[i]: if "</suppress>" in xml_lines[i]:
break break
i += 1 i += 1
reason = f"{last_comment} -- {packages}" if last_comment else "Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml" reason = (last_comment + " -- " + packages) if last_comment else "Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml"
# Add suppressions # Add suppressions
for cve_id in cve_ids: for cve_id in cve_ids:
@ -67,9 +67,9 @@ with open(os.path.join(script_dir, "../.snyk"), "w") as snyk_file:
snyk_file.write("# Snyk (https://snyk.io) policy file, provides ignores for known false positives.\n") snyk_file.write("# Snyk (https://snyk.io) policy file, provides ignores for known false positives.\n")
snyk_file.write("# This file is autogenerated from .build/dependency-check-suppressions.xml\n") snyk_file.write("# This file is autogenerated from .build/dependency-check-suppressions.xml\n")
snyk_file.write("version: v1.25.0\n") snyk_file.write("version: v1.25.0\n")
snyk_file.write(f"ignore:\n") snyk_file.write("ignore:\n")
for cve_id, ignores in snyk_data["ignore"].items(): for cve_id, ignores in sorted(snyk_data["ignore"].items()):
snyk_file.write(f" {cve_id}:\n") snyk_file.write(" {}:\n".format(cve_id))
for ignore in ignores: for ignore in ignores:
snyk_file.write(f" - reason: {ignore['reason']}\n") snyk_file.write(" - reason: {}\n".format(ignore['reason']))

44
.snyk
View File

@ -2,24 +2,8 @@
# This file is autogenerated from .build/dependency-check-suppressions.xml # This file is autogenerated from .build/dependency-check-suppressions.xml
version: v1.25.0 version: v1.25.0
ignore: ignore:
CVE-2022-1471:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
CVE-2022-25857:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
CVE-2022-38749:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
CVE-2022-38750:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
CVE-2022-38751:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
CVE-2022-38752:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
CVE-2022-41854:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
CVE-2020-8908: CVE-2020-8908:
- reason: not applicable https://nvd.nist.gov/vuln/detail/CVE-2020-8908 -- ^pkg:maven/com\.google\.guava/guava@.*$ - reason: not applicable https://nvd.nist.gov/vuln/detail/CVE-2020-8908 -- ^pkg:maven/com\.google\.guava/guava@.*$
CVE-2023-2976:
- reason: not applicable https://nvd.nist.gov/vuln/detail/CVE-2020-8908 -- ^pkg:maven/com\.google\.guava/guava@.*$
CVE-2021-21290: CVE-2021-21290:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$ - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$
CVE-2021-21295: CVE-2021-21295:
@ -32,19 +16,39 @@ ignore:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$ - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$
CVE-2021-43797: CVE-2021-43797:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$ - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$
CVE-2022-1471:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
CVE-2022-24823: CVE-2022-24823:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$ - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$
CVE-2022-25857:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
CVE-2022-38749:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
CVE-2022-38750:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
CVE-2022-38751:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
CVE-2022-38752:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
CVE-2022-41854:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
CVE-2022-41881: CVE-2022-41881:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$ - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$
CVE-2023-34462:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$
CVE-2023-44487:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$
CVE-2022-42003: CVE-2022-42003:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17966 -- ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$ - reason: https://issues.apache.org/jira/browse/CASSANDRA-17966 -- ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$
CVE-2022-42004: CVE-2022-42004:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17966 -- ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$ - reason: https://issues.apache.org/jira/browse/CASSANDRA-17966 -- ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$
CVE-2023-2976:
- reason: not applicable https://nvd.nist.gov/vuln/detail/CVE-2020-8908 -- ^pkg:maven/com\.google\.guava/guava@.*$
CVE-2023-34462:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$
CVE-2023-35116: CVE-2023-35116:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17966 -- ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$ - reason: https://issues.apache.org/jira/browse/CASSANDRA-17966 -- ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$
CVE-2023-44487:
- reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$
CVE-2023-6378: CVE-2023-6378:
- reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml - reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
CVE-2024-12798:
- reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
CVE-2024-12801:
- reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml