search

Azure / azure-sqldb-spark

This project provides a client library that allows Azure SQL DB or SQL Server to act as an input source or output sink for Spark jobs.
MIT License
76 stars 52 forks source link

Rev plexus-utils version to 3.0.24 or later #67

Closed rohit489 closed 4 years ago

rohit489 commented 4 years ago

Version 1.0.2 of azure-sqldb-spark uses an older version of org.codehaus.plexus:plexus-utils (version 3.0.20 ). This version of plexus-utils is flagged by component governance as being vulnerable to Directory Traversal. Can 3.0.24 or later version of Plexus-utils be used ?

Fokko commented 4 years ago

I'm not seeing this in the dependency tree:

[INFO] ---------------< com.microsoft.azure:azure-sqldb-spark >----------------
[INFO] Building com.microsoft.azure:azure-sqldb-spark 1.0.0
[INFO] --------------------------------[ jar ]---------------------------------
[INFO] 
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ azure-sqldb-spark ---
[INFO] com.microsoft.azure:azure-sqldb-spark:jar:1.0.0
[INFO] +- org.scala-lang:scala-library:jar:2.11.8:compile
[INFO] +- junit:junit:jar:4.8.1:test
[INFO] +- org.apache.spark:spark-core_2.11:jar:2.2.2:provided
[INFO] |  +- org.apache.avro:avro:jar:1.7.7:provided
[INFO] |  |  +- org.codehaus.jackson:jackson-core-asl:jar:1.9.13:provided
[INFO] |  |  +- org.codehaus.jackson:jackson-mapper-asl:jar:1.9.13:provided
[INFO] |  |  +- com.thoughtworks.paranamer:paranamer:jar:2.3:provided
[INFO] |  |  \- org.apache.commons:commons-compress:jar:1.4.1:provided
[INFO] |  |     \- org.tukaani:xz:jar:1.0:provided
[INFO] |  +- org.apache.avro:avro-mapred:jar:hadoop2:1.7.7:provided
[INFO] |  |  +- org.apache.avro:avro-ipc:jar:1.7.7:provided
[INFO] |  |  \- org.apache.avro:avro-ipc:jar:tests:1.7.7:provided
[INFO] |  +- com.twitter:chill_2.11:jar:0.8.0:provided
[INFO] |  |  \- com.esotericsoftware:kryo-shaded:jar:3.0.3:provided
[INFO] |  |     +- com.esotericsoftware:minlog:jar:1.3.0:provided
[INFO] |  |     \- org.objenesis:objenesis:jar:2.1:provided
[INFO] |  +- com.twitter:chill-java:jar:0.8.0:provided
[INFO] |  +- org.apache.xbean:xbean-asm5-shaded:jar:4.4:provided
[INFO] |  +- org.apache.hadoop:hadoop-client:jar:2.6.5:provided
[INFO] |  |  +- org.apache.hadoop:hadoop-common:jar:2.6.5:provided
[INFO] |  |  |  +- commons-cli:commons-cli:jar:1.2:provided
[INFO] |  |  |  +- xmlenc:xmlenc:jar:0.52:provided
[INFO] |  |  |  +- commons-httpclient:commons-httpclient:jar:3.1:provided
[INFO] |  |  |  +- commons-io:commons-io:jar:2.4:provided
[INFO] |  |  |  +- commons-collections:commons-collections:jar:3.2.2:provided
[INFO] |  |  |  +- commons-lang:commons-lang:jar:2.6:provided
[INFO] |  |  |  +- commons-configuration:commons-configuration:jar:1.6:provided
[INFO] |  |  |  |  +- commons-digester:commons-digester:jar:1.8:provided
[INFO] |  |  |  |  |  \- commons-beanutils:commons-beanutils:jar:1.7.0:provided
[INFO] |  |  |  |  \- commons-beanutils:commons-beanutils-core:jar:1.8.0:provided
[INFO] |  |  |  +- com.google.protobuf:protobuf-java:jar:2.5.0:provided
[INFO] |  |  |  +- org.apache.hadoop:hadoop-auth:jar:2.6.5:provided
[INFO] |  |  |  |  \- org.apache.directory.server:apacheds-kerberos-codec:jar:2.0.0-M15:provided
[INFO] |  |  |  |     +- org.apache.directory.server:apacheds-i18n:jar:2.0.0-M15:provided
[INFO] |  |  |  |     +- org.apache.directory.api:api-asn1-api:jar:1.0.0-M20:provided
[INFO] |  |  |  |     \- org.apache.directory.api:api-util:jar:1.0.0-M20:provided
[INFO] |  |  |  +- org.apache.curator:curator-client:jar:2.6.0:provided
[INFO] |  |  |  \- org.htrace:htrace-core:jar:3.0.4:provided
[INFO] |  |  +- org.apache.hadoop:hadoop-hdfs:jar:2.6.5:provided
[INFO] |  |  |  +- org.mortbay.jetty:jetty-util:jar:6.1.26:provided
[INFO] |  |  |  \- xerces:xercesImpl:jar:2.9.1:provided
[INFO] |  |  |     \- xml-apis:xml-apis:jar:1.3.04:provided
[INFO] |  |  +- org.apache.hadoop:hadoop-mapreduce-client-app:jar:2.6.5:provided
[INFO] |  |  |  +- org.apache.hadoop:hadoop-mapreduce-client-common:jar:2.6.5:provided
[INFO] |  |  |  |  +- org.apache.hadoop:hadoop-yarn-client:jar:2.6.5:provided
[INFO] |  |  |  |  \- org.apache.hadoop:hadoop-yarn-server-common:jar:2.6.5:provided
[INFO] |  |  |  \- org.apache.hadoop:hadoop-mapreduce-client-shuffle:jar:2.6.5:provided
[INFO] |  |  +- org.apache.hadoop:hadoop-yarn-api:jar:2.6.5:provided
[INFO] |  |  +- org.apache.hadoop:hadoop-mapreduce-client-core:jar:2.6.5:provided
[INFO] |  |  |  \- org.apache.hadoop:hadoop-yarn-common:jar:2.6.5:provided
[INFO] |  |  |     +- javax.xml.bind:jaxb-api:jar:2.2.2:provided
[INFO] |  |  |     |  \- javax.xml.stream:stax-api:jar:1.0-2:provided
[INFO] |  |  |     +- org.codehaus.jackson:jackson-jaxrs:jar:1.9.13:provided
[INFO] |  |  |     \- org.codehaus.jackson:jackson-xc:jar:1.9.13:provided
[INFO] |  |  +- org.apache.hadoop:hadoop-mapreduce-client-jobclient:jar:2.6.5:provided
[INFO] |  |  \- org.apache.hadoop:hadoop-annotations:jar:2.6.5:provided
[INFO] |  +- org.apache.spark:spark-launcher_2.11:jar:2.2.2:provided
[INFO] |  +- org.apache.spark:spark-network-common_2.11:jar:2.2.2:provided
[INFO] |  |  +- org.fusesource.leveldbjni:leveldbjni-all:jar:1.8:provided
[INFO] |  |  \- com.fasterxml.jackson.core:jackson-annotations:jar:2.6.5:provided
[INFO] |  +- org.apache.spark:spark-network-shuffle_2.11:jar:2.2.2:provided
[INFO] |  +- org.apache.spark:spark-unsafe_2.11:jar:2.2.2:provided
[INFO] |  +- net.java.dev.jets3t:jets3t:jar:0.9.3:provided
[INFO] |  |  +- org.apache.httpcomponents:httpcore:jar:4.3.3:provided
[INFO] |  |  +- org.apache.httpcomponents:httpclient:jar:4.3.6:provided
[INFO] |  |  +- javax.activation:activation:jar:1.1.1:compile
[INFO] |  |  +- mx4j:mx4j:jar:3.0.2:provided
[INFO] |  |  +- javax.mail:mail:jar:1.4.7:compile
[INFO] |  |  +- org.bouncycastle:bcprov-jdk15on:jar:1.51:provided
[INFO] |  |  \- com.jamesmurty.utils:java-xmlbuilder:jar:1.0:provided
[INFO] |  |     \- net.iharder:base64:jar:2.3.8:provided
[INFO] |  +- org.apache.curator:curator-recipes:jar:2.6.0:provided
[INFO] |  |  +- org.apache.curator:curator-framework:jar:2.6.0:provided
[INFO] |  |  +- org.apache.zookeeper:zookeeper:jar:3.4.6:provided
[INFO] |  |  \- com.google.guava:guava:jar:16.0.1:provided
[INFO] |  +- javax.servlet:javax.servlet-api:jar:3.1.0:provided
[INFO] |  +- org.apache.commons:commons-lang3:jar:3.5:compile
[INFO] |  +- org.apache.commons:commons-math3:jar:3.4.1:provided
[INFO] |  +- com.google.code.findbugs:jsr305:jar:1.3.9:provided
[INFO] |  +- org.slf4j:slf4j-api:jar:1.7.16:compile
[INFO] |  +- org.slf4j:jul-to-slf4j:jar:1.7.16:provided
[INFO] |  +- org.slf4j:jcl-over-slf4j:jar:1.7.16:provided
[INFO] |  +- log4j:log4j:jar:1.2.17:provided
[INFO] |  +- org.slf4j:slf4j-log4j12:jar:1.7.16:provided
[INFO] |  +- com.ning:compress-lzf:jar:1.0.3:provided
[INFO] |  +- org.xerial.snappy:snappy-java:jar:1.1.2.6:provided
[INFO] |  +- net.jpountz.lz4:lz4:jar:1.3.0:provided
[INFO] |  +- org.roaringbitmap:RoaringBitmap:jar:0.5.11:provided
[INFO] |  +- commons-net:commons-net:jar:2.2:provided
[INFO] |  +- org.json4s:json4s-jackson_2.11:jar:3.2.11:provided
[INFO] |  |  \- org.json4s:json4s-core_2.11:jar:3.2.11:provided
[INFO] |  |     +- org.json4s:json4s-ast_2.11:jar:3.2.11:provided
[INFO] |  |     \- org.scala-lang:scalap:jar:2.11.0:provided
[INFO] |  |        \- org.scala-lang:scala-compiler:jar:2.11.0:provided
[INFO] |  +- org.glassfish.jersey.core:jersey-client:jar:2.22.2:provided
[INFO] |  |  +- javax.ws.rs:javax.ws.rs-api:jar:2.0.1:provided
[INFO] |  |  +- org.glassfish.hk2:hk2-api:jar:2.4.0-b34:provided
[INFO] |  |  |  +- org.glassfish.hk2:hk2-utils:jar:2.4.0-b34:provided
[INFO] |  |  |  \- org.glassfish.hk2.external:aopalliance-repackaged:jar:2.4.0-b34:provided
[INFO] |  |  +- org.glassfish.hk2.external:javax.inject:jar:2.4.0-b34:provided
[INFO] |  |  \- org.glassfish.hk2:hk2-locator:jar:2.4.0-b34:provided
[INFO] |  |     \- org.javassist:javassist:jar:3.18.1-GA:provided
[INFO] |  +- org.glassfish.jersey.core:jersey-common:jar:2.22.2:provided
[INFO] |  |  +- javax.annotation:javax.annotation-api:jar:1.2:provided
[INFO] |  |  +- org.glassfish.jersey.bundles.repackaged:jersey-guava:jar:2.22.2:provided
[INFO] |  |  \- org.glassfish.hk2:osgi-resource-locator:jar:1.0.1:provided
[INFO] |  +- org.glassfish.jersey.core:jersey-server:jar:2.22.2:provided
[INFO] |  |  +- org.glassfish.jersey.media:jersey-media-jaxb:jar:2.22.2:provided
[INFO] |  |  \- javax.validation:validation-api:jar:1.1.0.Final:provided
[INFO] |  +- org.glassfish.jersey.containers:jersey-container-servlet:jar:2.22.2:provided
[INFO] |  +- org.glassfish.jersey.containers:jersey-container-servlet-core:jar:2.22.2:provided
[INFO] |  +- io.netty:netty-all:jar:4.0.43.Final:provided
[INFO] |  +- io.netty:netty:jar:3.9.9.Final:provided
[INFO] |  +- com.clearspring.analytics:stream:jar:2.7.0:provided
[INFO] |  +- io.dropwizard.metrics:metrics-core:jar:3.1.2:provided
[INFO] |  +- io.dropwizard.metrics:metrics-jvm:jar:3.1.2:provided
[INFO] |  +- io.dropwizard.metrics:metrics-json:jar:3.1.2:provided
[INFO] |  +- io.dropwizard.metrics:metrics-graphite:jar:3.1.2:provided
[INFO] |  +- com.fasterxml.jackson.core:jackson-databind:jar:2.6.5:provided
[INFO] |  |  \- com.fasterxml.jackson.core:jackson-core:jar:2.6.5:provided
[INFO] |  +- com.fasterxml.jackson.module:jackson-module-scala_2.11:jar:2.6.5:provided
[INFO] |  |  \- com.fasterxml.jackson.module:jackson-module-paranamer:jar:2.6.5:provided
[INFO] |  +- org.apache.ivy:ivy:jar:2.4.0:provided
[INFO] |  +- oro:oro:jar:2.0.8:provided
[INFO] |  +- net.razorvine:pyrolite:jar:4.13:provided
[INFO] |  +- net.sf.py4j:py4j:jar:0.10.7:provided
[INFO] |  +- org.apache.spark:spark-tags_2.11:jar:2.2.2:provided
[INFO] |  +- org.apache.commons:commons-crypto:jar:1.0.0:provided
[INFO] |  \- org.spark-project.spark:unused:jar:1.0.0:provided
[INFO] +- org.apache.spark:spark-sql_2.11:jar:2.2.1:provided
[INFO] |  +- com.univocity:univocity-parsers:jar:2.2.1:provided
[INFO] |  +- org.apache.spark:spark-sketch_2.11:jar:2.2.1:provided
[INFO] |  +- org.apache.spark:spark-catalyst_2.11:jar:2.2.1:provided
[INFO] |  |  +- org.codehaus.janino:janino:jar:3.0.0:provided
[INFO] |  |  +- org.codehaus.janino:commons-compiler:jar:3.0.0:provided
[INFO] |  |  \- org.antlr:antlr4-runtime:jar:4.5.3:provided
[INFO] |  +- org.apache.parquet:parquet-column:jar:1.8.2:provided
[INFO] |  |  +- org.apache.parquet:parquet-common:jar:1.8.2:provided
[INFO] |  |  \- org.apache.parquet:parquet-encoding:jar:1.8.2:provided
[INFO] |  \- org.apache.parquet:parquet-hadoop:jar:1.8.2:provided
[INFO] |     +- org.apache.parquet:parquet-format:jar:2.3.1:provided
[INFO] |     \- org.apache.parquet:parquet-jackson:jar:1.8.2:provided
[INFO] +- org.scalactic:scalactic_2.11:jar:3.0.4:compile
[INFO] |  \- org.scala-lang:scala-reflect:jar:2.11.11:compile
[INFO] +- org.scalatest:scalatest_2.11:jar:3.0.4:test
[INFO] |  +- org.scala-lang.modules:scala-xml_2.11:jar:1.0.5:provided
[INFO] |  \- org.scala-lang.modules:scala-parser-combinators_2.11:jar:1.0.4:provided
[INFO] +- com.microsoft.azure:adal4j:jar:1.2.0:compile
[INFO] |  +- com.nimbusds:oauth2-oidc-sdk:jar:5.18.1:compile
[INFO] |  |  +- com.github.stephenc.jcip:jcip-annotations:jar:1.0-1:compile
[INFO] |  |  +- org.apache.commons:commons-collections4:jar:4.1:compile
[INFO] |  |  +- net.minidev:json-smart:jar:1.3.1:compile
[INFO] |  |  +- com.nimbusds:lang-tag:jar:1.4.4:compile (version selected from constraint [1.4.3,))
[INFO] |  |  \- com.nimbusds:nimbus-jose-jwt:jar:8.16:compile (version selected from constraint [4.29,))
[INFO] |  +- com.google.code.gson:gson:jar:2.2.4:compile
[INFO] |  \- commons-codec:commons-codec:jar:1.10:compile
[INFO] \- com.microsoft.sqlserver:mssql-jdbc:jar:6.4.0.jre8:compile
arvindshmicrosoft commented 4 years ago

Closing as per notes in #95