diff --git a/.build/owasp/dependency-check-suppressions.xml b/.build/owasp/dependency-check-suppressions.xml index 25562f9449..f938b05f28 100644 --- a/.build/owasp/dependency-check-suppressions.xml +++ b/.build/owasp/dependency-check-suppressions.xml @@ -20,18 +20,6 @@ https://jeremylong.github.io/DependencyCheck/general/suppression.html --> - - - ^pkg:maven/org\.yaml/snakeyaml@.*$ - CVE-2022-1471 - CVE-2022-25857 - CVE-2022-38749 - CVE-2022-38750 - CVE-2022-38751 - CVE-2022-38752 - CVE-2022-41854 - - ^pkg:maven/io\.netty/netty\-.*@.*$ diff --git a/.build/parent-pom-template.xml b/.build/parent-pom-template.xml index f13aaf75cc..2331eeb1a6 100644 --- a/.build/parent-pom-template.xml +++ b/.build/parent-pom-template.xml @@ -442,9 +442,9 @@ com.fasterxml.jackson.dataformat jackson-dataformat-yaml - - 2.13.2 + 2.19.2 test + snakeyaml @@ -465,7 +465,7 @@ org.yaml snakeyaml - 1.26 + 2.1 junit @@ -514,6 +514,16 @@ harry-core 0.0.1 test + + + com.fasterxml.jackson.core + jackson-databind + + + com.fasterxml.jackson.core + jackson-annotations + + org.reflections @@ -532,6 +542,12 @@ wiremock-jre8 2.35.0 test + + + com.fasterxml.jackson.core + jackson-annotations + + com.puppycrawl.tools diff --git a/.snyk b/.snyk index d486fc2983..79150117f0 100644 --- a/.snyk +++ b/.snyk @@ -2,20 +2,6 @@ # This file is autogenerated from .build/dependency-check-suppressions.xml version: v1.25.0 ignore: - CVE-2022-1471: - - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$ - CVE-2022-25857: - - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$ - CVE-2022-38749: - - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$ - CVE-2022-38750: - - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$ - CVE-2022-38751: - - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$ - CVE-2022-38752: - - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$ - CVE-2022-41854: - - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$ CVE-2023-44487: - reason: https://issues.apache.org/jira/browse/CASSANDRA-18943 -- ^pkg:maven/io\.netty/netty\-.*@.*$ CVE-2023-6378: diff --git a/CHANGES.txt b/CHANGES.txt index 273ccebbae..c5189b42c3 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -1,4 +1,5 @@ 5.0.6 + * Upgrade jackson-dataformat-yaml to 2.19.2 and snakeyaml to 2.1 (CASSANDRA-18875) * Represent complex settings as JSON on system_views.settings table (CASSANDRA-20827) * Expose StorageService.dropPreparedStatements via JMX (CASSANDRA-20870) * Sort SSTable TOC entries for determinism (CASSANDRA-20494) diff --git a/src/java/org/apache/cassandra/config/YamlConfigurationLoader.java b/src/java/org/apache/cassandra/config/YamlConfigurationLoader.java index edff7be8ec..a312aa47dd 100644 --- a/src/java/org/apache/cassandra/config/YamlConfigurationLoader.java +++ b/src/java/org/apache/cassandra/config/YamlConfigurationLoader.java @@ -52,6 +52,8 @@ import org.yaml.snakeyaml.introspector.MissingProperty; import org.yaml.snakeyaml.introspector.Property; import org.yaml.snakeyaml.introspector.PropertyUtils; import org.yaml.snakeyaml.nodes.Node; +import org.yaml.snakeyaml.parser.ParserImpl; +import org.yaml.snakeyaml.resolver.Resolver; import static org.apache.cassandra.config.CassandraRelevantProperties.ALLOW_DUPLICATE_CONFIG_KEYS; import static org.apache.cassandra.config.CassandraRelevantProperties.ALLOW_NEW_OLD_CONFIG_KEYS; @@ -195,7 +197,7 @@ public class YamlConfigurationLoader implements ConfigurationLoader private static void verifyReplacements(Map, Map> replacements, byte[] configBytes) { - LoaderOptions loaderOptions = new LoaderOptions(); + LoaderOptions loaderOptions = getDefaultLoaderOptions(); loaderOptions.setAllowDuplicateKeys(ALLOW_DUPLICATE_CONFIG_KEYS.getBoolean()); Yaml rawYaml = new Yaml(loaderOptions); @@ -222,14 +224,7 @@ public class YamlConfigurationLoader implements ConfigurationLoader constructor.setPropertyUtils(propertiesChecker); Yaml yaml = new Yaml(constructor); Node node = yaml.represent(map); - constructor.setComposer(new Composer(null, null) - { - @Override - public Node getSingleNode() - { - return node; - } - }); + constructor.setComposer(getDefaultComposer(node)); T value = (T) constructor.getSingleData(klass); if (shouldCheck) propertiesChecker.check(); @@ -256,18 +251,23 @@ public class YamlConfigurationLoader implements ConfigurationLoader constructor.setPropertyUtils(propertiesChecker); Yaml yaml = new Yaml(constructor); Node node = yaml.represent(map); - constructor.setComposer(new Composer(null, null) + constructor.setComposer(getDefaultComposer(node)); + T value = (T) constructor.getSingleData(klass); + if (shouldCheck) + propertiesChecker.check(); + return value; + } + + private static Composer getDefaultComposer(Node node) + { + return new Composer(new ParserImpl(null), new Resolver(), getDefaultLoaderOptions()) { @Override public Node getSingleNode() { return node; } - }); - T value = (T) constructor.getSingleData(klass); - if (shouldCheck) - propertiesChecker.check(); - return value; + }; } @VisibleForTesting @@ -275,7 +275,7 @@ public class YamlConfigurationLoader implements ConfigurationLoader { CustomConstructor(Class theRoot, ClassLoader classLoader) { - super(theRoot, classLoader); + super(theRoot, classLoader, getDefaultLoaderOptions()); TypeDescription seedDesc = new TypeDescription(ParameterizedClass.class); seedDesc.putMapPropertyType("parameters", String.class, String.class); @@ -426,5 +426,12 @@ public class YamlConfigurationLoader implements ConfigurationLoader logger.warn("{} parameters have been deprecated. They have new names and/or value format; For more information, please refer to NEWS.txt", deprecationWarnings); } } + + public static LoaderOptions getDefaultLoaderOptions() + { + LoaderOptions loaderOptions = new LoaderOptions(); + loaderOptions.setCodePointLimit(64 * 1024 * 1024); // 64 MiB + return loaderOptions; + } } diff --git a/src/java/org/apache/cassandra/tools/JMXTool.java b/src/java/org/apache/cassandra/tools/JMXTool.java index 8cf5748a2e..3e2fab5b3b 100644 --- a/src/java/org/apache/cassandra/tools/JMXTool.java +++ b/src/java/org/apache/cassandra/tools/JMXTool.java @@ -68,9 +68,11 @@ import io.airlift.airline.Command; import io.airlift.airline.Help; import io.airlift.airline.HelpOption; import io.airlift.airline.Option; +import org.apache.cassandra.config.YamlConfigurationLoader; import org.apache.cassandra.io.util.File; import org.apache.cassandra.io.util.FileInputStreamPlus; import org.apache.cassandra.utils.JsonUtils; +import org.yaml.snakeyaml.DumperOptions; import org.yaml.snakeyaml.TypeDescription; import org.yaml.snakeyaml.Yaml; import org.yaml.snakeyaml.constructor.Constructor; @@ -163,7 +165,7 @@ public class JMXTool { void dump(OutputStream output, Map map) throws IOException { - Representer representer = new Representer(); + Representer representer = new Representer(new DumperOptions()); representer.addClassTag(Info.class, Tag.MAP); // avoid the auto added tag Yaml yaml = new Yaml(representer); yaml.dump(map, new OutputStreamWriter(output)); @@ -394,6 +396,7 @@ public class JMXTool public CustomConstructor() { + super(YamlConfigurationLoader.getDefaultLoaderOptions()); this.rootTag = new Tag(ROOT); this.addTypeDescription(INFO_TYPE); } diff --git a/tools/stress/src/org/apache/cassandra/stress/StressProfile.java b/tools/stress/src/org/apache/cassandra/stress/StressProfile.java index cc668b5ad4..598a4f327a 100644 --- a/tools/stress/src/org/apache/cassandra/stress/StressProfile.java +++ b/tools/stress/src/org/apache/cassandra/stress/StressProfile.java @@ -37,6 +37,7 @@ import com.google.common.util.concurrent.Uninterruptibles; import com.datastax.driver.core.*; import com.datastax.driver.core.exceptions.AlreadyExistsException; import org.antlr.runtime.RecognitionException; +import org.apache.cassandra.config.YamlConfigurationLoader; import org.apache.cassandra.cql3.CQLFragmentParser; import org.apache.cassandra.cql3.CqlParser; import org.apache.cassandra.cql3.statements.ModificationStatement; @@ -809,7 +810,7 @@ public class StressProfile implements Serializable { try { - Constructor constructor = new Constructor(StressYaml.class); + Constructor constructor = new Constructor(StressYaml.class, YamlConfigurationLoader.getDefaultLoaderOptions()); Yaml yaml = new Yaml(constructor);