diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml index 34bf3d2..2e72203 100644 --- a/.github/workflows/ci-build.yml +++ b/.github/workflows/ci-build.yml @@ -1,5 +1,4 @@ name: CI Build - on: push: branches: @@ -10,8 +9,14 @@ jobs: build: runs-on: ubuntu-20.04 # UDFs fail with "VM error: Internal error: VM crashed" on ubuntu-latest concurrency: - group: ${{ github.workflow }}-${{ github.ref }} + group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.exasol_db_version }} cancel-in-progress: true + strategy: + fail-fast: false + matrix: + exasol_db_version: ["7.1.24"] + env: + DEFAULT_EXASOL_DB_VERSION: "7.1.24" steps: - name: Checkout the repository uses: actions/checkout@v4 @@ -31,6 +36,8 @@ jobs: path: ~/.sonar/cache key: ${{ runner.os }}-sonar restore-keys: ${{ runner.os }}-sonar + - name: Enable testcontainer reuse + run: echo 'testcontainers.reuse.enable=true' > "$HOME/.testcontainers.properties" - name: Write ADLSG2 accountkey file run: | echo "$ACCOUNTKEY" > accountkey.txt @@ -45,14 +52,15 @@ jobs: run: | JAVA_HOME=$JAVA_HOME_11_X64 mvn --batch-mode clean verify \ -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ - -DtrimStackTrace=false + -DtrimStackTrace=false \ + -Dcom.exasol.dockerdb.image=${{ matrix.exasol_db_version }} - name: Publish Test Report uses: scacap/action-surefire-report@v1 if: ${{ always() && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]' }} with: github_token: ${{ secrets.GITHUB_TOKEN }} - name: Sonar analysis - if: ${{ env.SONAR_TOKEN != null }} + if: ${{ env.SONAR_TOKEN != null && matrix.exasol_db_version == env.DEFAULT_EXASOL_DB_VERSION }} run: | JAVA_HOME=$JAVA_HOME_17_X64 mvn --batch-mode org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \ -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ diff --git a/.github/workflows/dependencies_check.yml b/.github/workflows/dependencies_check.yml index 3059964..4b6eadf 100644 --- a/.github/workflows/dependencies_check.yml +++ b/.github/workflows/dependencies_check.yml @@ -1,12 +1,15 @@ -name: Dependencies Check +name: Report Security Issues for Repository on: + workflow_dispatch: schedule: - cron: "0 2 * * *" jobs: - build: + report_security_issues: runs-on: ubuntu-latest + permissions: + issues: write steps: - uses: actions/checkout@v4 @@ -16,5 +19,17 @@ jobs: distribution: "temurin" java-version: 11 cache: "maven" - - name: Checking dependencies for vulnerabilities - run: mvn --batch-mode org.sonatype.ossindex.maven:ossindex-maven-plugin:audit -f pom.xml + + - name: Generate ossindex report + run: | + mvn org.sonatype.ossindex.maven:ossindex-maven-plugin:audit \ + org.sonatype.ossindex.maven:ossindex-maven-plugin:audit-aggregate \ + -Dossindex.reportFile=$(pwd)/ossindex-report.json \ + -Dossindex.fail=false + + - name: Report Security Issues + uses: exasol/python-toolbox/.github/actions/security-issues@main + with: + format: "maven" + command: "cat ossindex-report.json" + github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.project-keeper.yml b/.project-keeper.yml index bca77cf..82f2e91 100644 --- a/.project-keeper.yml +++ b/.project-keeper.yml @@ -9,3 +9,8 @@ linkReplacements: excludes: - "E-PK-CORE-18: Outdated content: '.github/workflows/ci-build.yml'" - "E-PK-CORE-18: Outdated content: '.github/workflows/release_droid_prepare_original_checksum.yml'" +build: + runnerOs: ubuntu-20.04 + freeDiskSpace: false + exasolDbVersions: + - "7.1.24" diff --git a/dependencies.md b/dependencies.md index ff906c5..25300fc 100644 --- a/dependencies.md +++ b/dependencies.md @@ -3,51 +3,52 @@ ## Compile Dependencies -| Dependency | License | -| -------------------------------------------------------------- | -------------------------- | -| [Virtual Schema for document data in files][0] | [MIT License][1] | -| [error-reporting-java][2] | [MIT License][3] | -| [Microsoft Azure client library for File Storage Data Lake][4] | [The MIT License (MIT)][5] | -| [Microsoft Azure client library for Identity][4] | [The MIT License (MIT)][5] | -| [Microsoft Azure Java Core Library][4] | [The MIT License (MIT)][5] | +| Dependency | License | +| -------------------------------------------------------------- | --------------------------------------------- | +| [Virtual Schema for document data in files][0] | [MIT License][1] | +| [error-reporting-java][2] | [MIT License][3] | +| [Microsoft Azure client library for File Storage Data Lake][4] | [The MIT License (MIT)][5] | +| [HTTP functionality for the Reactor Netty library][6] | [The Apache Software License, Version 2.0][7] | +| [Microsoft Azure client library for Identity][4] | [The MIT License (MIT)][5] | +| [Microsoft Azure Java Core Library][4] | [The MIT License (MIT)][5] | ## Test Dependencies | Dependency | License | | ---------------------------------------------- | --------------------------------- | -| [Hamcrest][6] | [BSD License 3][7] | +| [Hamcrest][8] | [BSD License 3][9] | | [Virtual Schema for document data in files][0] | [MIT License][1] | -| [JUnit Jupiter Params][8] | [Eclipse Public License v2.0][9] | -| [mockito-core][10] | [MIT][11] | -| [Test Database Builder for Java][12] | [MIT License][13] | -| [udf-debugging-java][14] | [MIT License][15] | -| [Matcher for SQL Result Sets][16] | [MIT License][17] | -| [exasol-test-setup-abstraction-java][18] | [MIT License][19] | -| [Performance Test Recorder Java][20] | [MIT License][21] | -| [EqualsVerifier \| release normal jar][22] | [Apache License, Version 2.0][23] | -| [JaCoCo :: Agent][24] | [Eclipse Public License 2.0][25] | +| [JUnit Jupiter Params][10] | [Eclipse Public License v2.0][11] | +| [mockito-core][12] | [MIT][13] | +| [Test Database Builder for Java][14] | [MIT License][15] | +| [udf-debugging-java][16] | [MIT License][17] | +| [Matcher for SQL Result Sets][18] | [MIT License][19] | +| [exasol-test-setup-abstraction-java][20] | [MIT License][21] | +| [Performance Test Recorder Java][22] | [MIT License][23] | +| [EqualsVerifier \| release normal jar][24] | [Apache License, Version 2.0][7] | +| [JaCoCo :: Agent][25] | [Eclipse Public License 2.0][26] | ## Plugin Dependencies -| Dependency | License | -| ------------------------------------------------------- | --------------------------------- | -| [SonarQube Scanner for Maven][26] | [GNU LGPL 3][27] | -| [Apache Maven Compiler Plugin][28] | [Apache-2.0][23] | -| [Apache Maven Enforcer Plugin][29] | [Apache-2.0][23] | -| [Maven Flatten Plugin][30] | [Apache Software Licenese][23] | -| [org.sonatype.ossindex.maven:ossindex-maven-plugin][31] | [ASL2][32] | -| [Maven Surefire Plugin][33] | [Apache-2.0][23] | -| [Versions Maven Plugin][34] | [Apache License, Version 2.0][23] | -| [duplicate-finder-maven-plugin Maven Mojo][35] | [Apache License 2.0][36] | -| [Project keeper maven plugin][37] | [The MIT License][38] | -| [Apache Maven Assembly Plugin][39] | [Apache-2.0][23] | -| [Apache Maven JAR Plugin][40] | [Apache License, Version 2.0][23] | -| [Artifact reference checker and unifier][41] | [MIT License][42] | -| [Apache Maven Dependency Plugin][43] | [Apache-2.0][23] | -| [Maven Failsafe Plugin][44] | [Apache-2.0][23] | -| [JaCoCo :: Maven Plugin][45] | [Eclipse Public License 2.0][25] | -| [error-code-crawler-maven-plugin][46] | [MIT License][47] | -| [Reproducible Build Maven Plugin][48] | [Apache 2.0][32] | +| Dependency | License | +| ------------------------------------------------------- | -------------------------------- | +| [SonarQube Scanner for Maven][27] | [GNU LGPL 3][28] | +| [Apache Maven Compiler Plugin][29] | [Apache-2.0][7] | +| [Apache Maven Enforcer Plugin][30] | [Apache-2.0][7] | +| [Maven Flatten Plugin][31] | [Apache Software Licenese][7] | +| [org.sonatype.ossindex.maven:ossindex-maven-plugin][32] | [ASL2][33] | +| [Maven Surefire Plugin][34] | [Apache-2.0][7] | +| [Versions Maven Plugin][35] | [Apache License, Version 2.0][7] | +| [duplicate-finder-maven-plugin Maven Mojo][36] | [Apache License 2.0][37] | +| [Project keeper maven plugin][38] | [The MIT License][39] | +| [Apache Maven Assembly Plugin][40] | [Apache-2.0][7] | +| [Apache Maven JAR Plugin][41] | [Apache License, Version 2.0][7] | +| [Artifact reference checker and unifier][42] | [MIT License][43] | +| [Apache Maven Dependency Plugin][44] | [Apache-2.0][7] | +| [Maven Failsafe Plugin][45] | [Apache-2.0][7] | +| [JaCoCo :: Maven Plugin][46] | [Eclipse Public License 2.0][26] | +| [error-code-crawler-maven-plugin][47] | [MIT License][48] | +| [Reproducible Build Maven Plugin][49] | [Apache 2.0][33] | [0]: https://github.com/exasol/virtual-schema-common-document-files/ [1]: https://github.com/exasol/virtual-schema-common-document-files/blob/main/LICENSE @@ -55,46 +56,47 @@ [3]: https://github.com/exasol/error-reporting-java/blob/main/LICENSE [4]: https://github.com/Azure/azure-sdk-for-java [5]: http://opensource.org/licenses/MIT -[6]: http://hamcrest.org/JavaHamcrest/ -[7]: http://opensource.org/licenses/BSD-3-Clause -[8]: https://junit.org/junit5/ -[9]: https://www.eclipse.org/legal/epl-v20.html -[10]: https://github.com/mockito/mockito -[11]: https://github.com/mockito/mockito/blob/main/LICENSE -[12]: https://github.com/exasol/test-db-builder-java/ -[13]: https://github.com/exasol/test-db-builder-java/blob/main/LICENSE -[14]: https://github.com/exasol/udf-debugging-java/ -[15]: https://github.com/exasol/udf-debugging-java/blob/main/LICENSE -[16]: https://github.com/exasol/hamcrest-resultset-matcher/ -[17]: https://github.com/exasol/hamcrest-resultset-matcher/blob/main/LICENSE -[18]: https://github.com/exasol/exasol-test-setup-abstraction-java/ -[19]: https://github.com/exasol/exasol-test-setup-abstraction-java/blob/main/LICENSE -[20]: https://github.com/exasol/performance-test-recorder-java/ -[21]: https://github.com/exasol/performance-test-recorder-java/blob/main/LICENSE -[22]: https://www.jqno.nl/equalsverifier -[23]: https://www.apache.org/licenses/LICENSE-2.0.txt -[24]: https://www.eclemma.org/jacoco/index.html -[25]: https://www.eclipse.org/legal/epl-2.0/ -[26]: http://sonarsource.github.io/sonar-scanner-maven/ -[27]: http://www.gnu.org/licenses/lgpl.txt -[28]: https://maven.apache.org/plugins/maven-compiler-plugin/ -[29]: https://maven.apache.org/enforcer/maven-enforcer-plugin/ -[30]: https://www.mojohaus.org/flatten-maven-plugin/ -[31]: https://sonatype.github.io/ossindex-maven/maven-plugin/ -[32]: http://www.apache.org/licenses/LICENSE-2.0.txt -[33]: https://maven.apache.org/surefire/maven-surefire-plugin/ -[34]: https://www.mojohaus.org/versions/versions-maven-plugin/ -[35]: https://basepom.github.io/duplicate-finder-maven-plugin -[36]: http://www.apache.org/licenses/LICENSE-2.0.html -[37]: https://github.com/exasol/project-keeper/ -[38]: https://github.com/exasol/project-keeper/blob/main/LICENSE -[39]: https://maven.apache.org/plugins/maven-assembly-plugin/ -[40]: https://maven.apache.org/plugins/maven-jar-plugin/ -[41]: https://github.com/exasol/artifact-reference-checker-maven-plugin/ -[42]: https://github.com/exasol/artifact-reference-checker-maven-plugin/blob/main/LICENSE -[43]: https://maven.apache.org/plugins/maven-dependency-plugin/ -[44]: https://maven.apache.org/surefire/maven-failsafe-plugin/ -[45]: https://www.jacoco.org/jacoco/trunk/doc/maven.html -[46]: https://github.com/exasol/error-code-crawler-maven-plugin/ -[47]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE -[48]: http://zlika.github.io/reproducible-build-maven-plugin +[6]: https://github.com/reactor/reactor-netty +[7]: https://www.apache.org/licenses/LICENSE-2.0.txt +[8]: http://hamcrest.org/JavaHamcrest/ +[9]: http://opensource.org/licenses/BSD-3-Clause +[10]: https://junit.org/junit5/ +[11]: https://www.eclipse.org/legal/epl-v20.html +[12]: https://github.com/mockito/mockito +[13]: https://opensource.org/licenses/MIT +[14]: https://github.com/exasol/test-db-builder-java/ +[15]: https://github.com/exasol/test-db-builder-java/blob/main/LICENSE +[16]: https://github.com/exasol/udf-debugging-java/ +[17]: https://github.com/exasol/udf-debugging-java/blob/main/LICENSE +[18]: https://github.com/exasol/hamcrest-resultset-matcher/ +[19]: https://github.com/exasol/hamcrest-resultset-matcher/blob/main/LICENSE +[20]: https://github.com/exasol/exasol-test-setup-abstraction-java/ +[21]: https://github.com/exasol/exasol-test-setup-abstraction-java/blob/main/LICENSE +[22]: https://github.com/exasol/performance-test-recorder-java/ +[23]: https://github.com/exasol/performance-test-recorder-java/blob/main/LICENSE +[24]: https://www.jqno.nl/equalsverifier +[25]: https://www.eclemma.org/jacoco/index.html +[26]: https://www.eclipse.org/legal/epl-2.0/ +[27]: http://sonarsource.github.io/sonar-scanner-maven/ +[28]: http://www.gnu.org/licenses/lgpl.txt +[29]: https://maven.apache.org/plugins/maven-compiler-plugin/ +[30]: https://maven.apache.org/enforcer/maven-enforcer-plugin/ +[31]: https://www.mojohaus.org/flatten-maven-plugin/ +[32]: https://sonatype.github.io/ossindex-maven/maven-plugin/ +[33]: http://www.apache.org/licenses/LICENSE-2.0.txt +[34]: https://maven.apache.org/surefire/maven-surefire-plugin/ +[35]: https://www.mojohaus.org/versions/versions-maven-plugin/ +[36]: https://basepom.github.io/duplicate-finder-maven-plugin +[37]: http://www.apache.org/licenses/LICENSE-2.0.html +[38]: https://github.com/exasol/project-keeper/ +[39]: https://github.com/exasol/project-keeper/blob/main/LICENSE +[40]: https://maven.apache.org/plugins/maven-assembly-plugin/ +[41]: https://maven.apache.org/plugins/maven-jar-plugin/ +[42]: https://github.com/exasol/artifact-reference-checker-maven-plugin/ +[43]: https://github.com/exasol/artifact-reference-checker-maven-plugin/blob/main/LICENSE +[44]: https://maven.apache.org/plugins/maven-dependency-plugin/ +[45]: https://maven.apache.org/surefire/maven-failsafe-plugin/ +[46]: https://www.jacoco.org/jacoco/trunk/doc/maven.html +[47]: https://github.com/exasol/error-code-crawler-maven-plugin/ +[48]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE +[49]: http://zlika.github.io/reproducible-build-maven-plugin diff --git a/doc/changes/changelog.md b/doc/changes/changelog.md index e024057..6a5284f 100644 --- a/doc/changes/changelog.md +++ b/doc/changes/changelog.md @@ -1,5 +1,6 @@ # Changes +* [1.4.5](changes_1.4.5.md) * [1.4.4](changes_1.4.4.md) * [1.4.3](changes_1.4.3.md) * [1.4.2](changes_1.4.2.md) diff --git a/doc/changes/changes_1.4.5.md b/doc/changes/changes_1.4.5.md new file mode 100644 index 0000000..e09357a --- /dev/null +++ b/doc/changes/changes_1.4.5.md @@ -0,0 +1,38 @@ +# Virtual Schema for Document Data in Files on Azure Data Lake Storage Gen 2 1.4.5, released 2023-11-22 + +Code name: Fix CVE-2023-34062 in `io.projectreactor.netty:reactor-netty-http` + +## Summary + +This release fixes CVE-2023-34062 (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (7.5)) in compile dependency `io.projectreactor.netty:reactor-netty-http`. + +## Security + +* #43: Fix CVE-2023-34062 in `io.projectreactor.netty:reactor-netty-http` + +## Dependency Updates + +### Compile Dependency Updates + +* Updated `com.azure:azure-core:1.44.1` to `1.45.0` +* Updated `com.azure:azure-identity:1.10.4` to `1.11.0` +* Updated `com.azure:azure-storage-file-datalake:12.17.0` to `12.18.0` +* Updated `com.exasol:virtual-schema-common-document-files:7.3.5` to `7.3.6` +* Added `io.projectreactor.netty:reactor-netty-http:1.0.39` + +### Test Dependency Updates + +* Updated `com.exasol:exasol-test-setup-abstraction-java:2.0.4` to `2.1.0` +* Updated `com.exasol:hamcrest-resultset-matcher:1.6.1` to `1.6.3` +* Updated `com.exasol:test-db-builder-java:3.5.1` to `3.5.2` +* Updated `com.exasol:virtual-schema-common-document-files:7.3.5` to `7.3.6` +* Updated `nl.jqno.equalsverifier:equalsverifier:3.15.2` to `3.15.3` +* Updated `org.junit.jupiter:junit-jupiter-params:5.10.0` to `5.10.1` +* Updated `org.mockito:mockito-core:5.6.0` to `5.7.0` + +### Plugin Dependency Updates + +* Updated `com.exasol:project-keeper-maven-plugin:2.9.14` to `2.9.16` +* Updated `org.apache.maven.plugins:maven-dependency-plugin:3.6.0` to `3.6.1` +* Updated `org.apache.maven.plugins:maven-failsafe-plugin:3.1.2` to `3.2.2` +* Updated `org.apache.maven.plugins:maven-surefire-plugin:3.1.2` to `3.2.2` diff --git a/doc/user_guide/user_guide.md b/doc/user_guide/user_guide.md index 72c75e7..c44a8ea 100644 --- a/doc/user_guide/user_guide.md +++ b/doc/user_guide/user_guide.md @@ -17,7 +17,7 @@ Next create the Adapter Script: ```sql CREATE OR REPLACE JAVA ADAPTER SCRIPT ADAPTER.AZURE_DATALAKE_STORAGE_GEN2_FILES_ADAPTER AS %scriptclass com.exasol.adapter.RequestDispatcher; - %jar /buckets/bfsdefault/default/document-files-virtual-schema-dist-7.3.5-azure-datalake-storage-gen2-1.4.4.jar; + %jar /buckets/bfsdefault/default/document-files-virtual-schema-dist-7.3.6-azure-datalake-storage-gen2-1.4.5.jar; / ``` @@ -30,7 +30,7 @@ CREATE OR REPLACE JAVA SET SCRIPT ADAPTER.IMPORT_FROM_AZURE_DATA_LAKE_STORAGE_GE CONNECTION_NAME VARCHAR(500)) EMITS(...) AS %scriptclass com.exasol.adapter.document.UdfEntryPoint; - %jar /buckets/bfsdefault/default/document-files-virtual-schema-dist-7.3.5-azure-datalake-storage-gen2-1.4.4.jar; + %jar /buckets/bfsdefault/default/document-files-virtual-schema-dist-7.3.6-azure-datalake-storage-gen2-1.4.5.jar; / ``` diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom index cd66b66..215c31b 100644 --- a/pk_generated_parent.pom +++ b/pk_generated_parent.pom @@ -3,7 +3,7 @@ 4.0.0 com.exasol azure-data-lake-storage-gen2-document-files-virtual-schema-generated-parent - 1.4.4 + 1.4.5 pom UTF-8 @@ -54,6 +54,12 @@ ${java.version} ${java.version} + true + + + -Xlint:all,-processing + + @@ -118,7 +124,7 @@ org.apache.maven.plugins maven-surefire-plugin - 3.1.2 + 3.2.2 @@ -222,7 +228,7 @@ org.apache.maven.plugins maven-dependency-plugin - 3.6.0 + 3.6.1 copy-jacoco @@ -242,10 +248,9 @@ org.apache.maven.plugins maven-failsafe-plugin - 3.1.2 + 3.2.2 - + -Djava.util.logging.config.file=src/test/resources/logging.properties ${argLine} true diff --git a/pom.xml b/pom.xml index a5eeafc..7846111 100644 --- a/pom.xml +++ b/pom.xml @@ -2,12 +2,12 @@ 4.0.0 azure-data-lake-storage-gen2-document-files-virtual-schema - 1.4.4 + 1.4.5 Virtual Schema for document data in files on Azure Data Lake Storage Gen 2 Adapter for document data access from files from Azure Data Lake Storage Gen 2. https://github.com/exasol/azure-data-lake-storage-gen2-document-files-virtual-schema/ - 7.3.5 + 7.3.6 @@ -40,17 +40,23 @@ com.azure azure-storage-file-datalake - 12.17.0 + 12.18.0 + + + + io.projectreactor.netty + reactor-netty-http + 1.0.39 com.azure azure-identity - 1.10.4 + 1.11.0 com.azure azure-core - 1.44.1 + 1.45.0 @@ -69,20 +75,20 @@ org.junit.jupiter junit-jupiter-params - 5.10.0 + 5.10.1 test org.mockito mockito-core - 5.6.0 + 5.7.0 test com.exasol test-db-builder-java - 3.5.1 + 3.5.2 test @@ -94,13 +100,13 @@ com.exasol hamcrest-resultset-matcher - 1.6.1 + 1.6.3 test com.exasol exasol-test-setup-abstraction-java - 2.0.4 + 2.1.0 test @@ -112,7 +118,7 @@ nl.jqno.equalsverifier equalsverifier - 3.15.2 + 3.15.3 test @@ -152,7 +158,7 @@ com.exasol project-keeper-maven-plugin - 2.9.14 + 2.9.16 @@ -173,7 +179,7 @@ azure-data-lake-storage-gen2-document-files-virtual-schema-generated-parent com.exasol - 1.4.4 + 1.4.5 pk_generated_parent.pom diff --git a/src/test/java/com/exasol/adapter/document/files/IntegrationTestSetup.java b/src/test/java/com/exasol/adapter/document/files/IntegrationTestSetup.java index f764bb0..4383ba5 100644 --- a/src/test/java/com/exasol/adapter/document/files/IntegrationTestSetup.java +++ b/src/test/java/com/exasol/adapter/document/files/IntegrationTestSetup.java @@ -23,7 +23,7 @@ import jakarta.json.*; public class IntegrationTestSetup implements AutoCloseable { - private static final String ADAPTER_JAR = "document-files-virtual-schema-dist-7.3.5-azure-datalake-storage-gen2-1.4.4.jar"; + private static final String ADAPTER_JAR = "document-files-virtual-schema-dist-7.3.6-azure-datalake-storage-gen2-1.4.5.jar"; private final ExasolTestSetup exasolTestSetup; private final Connection exasolConnection; private final Statement exasolStatement;