cloudera / cloudera-scripts-for-log4j

Scripts for addressing log4j zero day security issue
Apache License 2.0
86 stars 68 forks source link

Script hangs/asks for user input if a war file has duplicate file #36

Open smenke opened 2 years ago

smenke commented 2 years ago

If a war file contains the same file twice the script will hang when it asks for a response from the user. This becomes an issue especially when running via Ansible or other automation.

This file has this issue: /opt/cloudera/parcels/CDH-5.16.1-1.cdh5.16.1.p3368.3632/lib/hbase-solr/lib/solr-4.10.3-cdh5.16.1.war

To see the issue, run these commands:

rm -r -f /tmp/unzip_target
mkdir /tmp/unzip_target
unzip -qq /opt/cloudera/parcels/CDH-5.16.1-1.cdh5.16.1.p3368.3632/lib/hbase-solr/lib/solr-4.10.3-cdh5.16.1.war -d /tmp/unzip_target
replace /tmp/unzip_target/WEB-INF/lib/jackson-core-asl-1.8.10.jar? [y]es, [n]o, [A]ll, [N]one, [r]ename:

A proposed fix for this is to add the overwrite option -o to the unzip command. I can create a PR for this.

sunilgovind commented 2 years ago

A duplicate file caused this prompt. We can override, but it may be too generic as we cant compare the file always. If we skip, it may be a problem again. Hence a manual verification is always good. For automation, and if the files are safe, you could think about adding "-o" to fix the automation.

smenke commented 2 years ago

Since the file is a duplicate, I would think that specifying either overwrite or skip would solve the issue since you only need one file and they are both the same. If the contents of the files are different I'd think that would cause other issues anyway with the application using the war file. Another option would be to add another environment variable that specifies the desired action (overwrite, skip, prompt).

TarunParimi commented 2 years ago

We dont face this issue in CDH6 and CDP and this particular file doesn't exist. If the issue is only there in CDH5, then it can be ignored since CDH5 need not be patched.

smenke commented 2 years ago

We are on CDH6 but the CDH5 files still reside and consequently the script hangs while running via automation. Even if we went through an effort to rid our servers of all CDH5 files, it is possible it could occur with other war files now or in the future.