Skip to content

Commit ac60de3

Browse files
aimanshariefclaude
aimansharief
and
claude
committed
fix: resolve Dependabot security vulnerabilities (Sunbird-Knowlg#89, Sunbird-Knowlg#90, Sunbird-Knowlg#87, #21)
- Bump org.apache.zookeeper:zookeeper 3.8.4 → 3.8.6 in root dependencyManagement (fixes CVE: hostname verification bypass + improper config handling) - Migrate graph-engine_2.13 tests from cassandra-unit to testcontainers-cassandra; upgrade snakeyaml 1.33 → 2.0 (fixes SnakeYaml Constructor Deserialization RCE); remove cassandra-unit:3.11.2.0 and its associated netty/snappy/jna overrides; add CassandraTestSupport singleton with reflection-based session injection - Bump org.apache.poi:poi-ooxml 3.17 → 5.4.0 and xmlbeans 3.0.0 → 5.2.1 in platform-common (fixes improper input validation in OOXML file parsing) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent 5960a86 commit ac60de3

6 files changed

Lines changed: 63 additions & 75 deletions

File tree

‎ontology-engine/graph-engine_2.13/pom.xml‎

Lines changed: 7 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@
5252
<dependency>
5353
<groupId>org.yaml</groupId>
5454
<artifactId>snakeyaml</artifactId>
55-
<version>1.33</version>
55+
<version>2.0</version>
5656
<scope>test</scope>
5757
</dependency>
5858
<dependency>
@@ -61,51 +61,6 @@
6161
<version>3.12.4</version>
6262
<scope>test</scope>
6363
</dependency>
64-
65-
<dependency>
66-
<groupId>org.cassandraunit</groupId>
67-
<artifactId>cassandra-unit</artifactId>
68-
<version>3.11.2.0</version>
69-
<scope>test</scope>
70-
<exclusions>
71-
<exclusion>
72-
<groupId>io.netty</groupId>
73-
<artifactId>netty-codec</artifactId>
74-
</exclusion>
75-
<exclusion>
76-
<groupId>io.netty</groupId>
77-
<artifactId>netty-handler</artifactId>
78-
</exclusion>
79-
<exclusion>
80-
<groupId>org.xerial.snappy</groupId>
81-
<artifactId>snappy-java</artifactId>
82-
</exclusion>
83-
</exclusions>
84-
</dependency>
85-
<dependency>
86-
<groupId>org.xerial.snappy</groupId>
87-
<artifactId>snappy-java</artifactId>
88-
<scope>test</scope>
89-
</dependency>
90-
<dependency>
91-
<groupId>io.netty</groupId>
92-
<artifactId>netty-codec</artifactId>
93-
<version>4.1.129.Final</version>
94-
<scope>test</scope>
95-
</dependency>
96-
<dependency>
97-
<groupId>net.java.dev.jna</groupId>
98-
<artifactId>jna</artifactId>
99-
<version>5.13.0</version>
100-
<scope>test</scope>
101-
</dependency>
102-
<dependency>
103-
<groupId>io.netty</groupId>
104-
<artifactId>netty-handler</artifactId>
105-
<version>4.1.129.Final</version>
106-
<scope>test</scope>
107-
</dependency>
108-
10964
<dependency>
11065
<groupId>com.dimafeng</groupId>
11166
<artifactId>testcontainers-scala_2.13</artifactId>
@@ -118,6 +73,12 @@
11873
<version>1.17.6</version>
11974
<scope>test</scope>
12075
</dependency>
76+
<dependency>
77+
<groupId>org.testcontainers</groupId>
78+
<artifactId>cassandra</artifactId>
79+
<version>1.17.6</version>
80+
<scope>test</scope>
81+
</dependency>
12182
<dependency>
12283
<groupId>com.github.codemonstur</groupId>
12384
<artifactId>embedded-redis</artifactId>

‎ontology-engine/graph-engine_2.13/src/test/scala/org/sunbird/graph/BaseSpec.scala‎

Lines changed: 51 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,59 @@
11
package org.sunbird.graph
22

3-
import java.io.File
4-
import com.typesafe.config.ConfigFactory
5-
import org.apache.commons.io.FileUtils
6-
import org.cassandraunit.utils.EmbeddedCassandraServerHelper
3+
import com.datastax.driver.core.{Cluster, ProtocolVersion, Session}
74
import redis.embedded.RedisServer
85
import org.scalatest.{AsyncFlatSpec, BeforeAndAfterAll, Matchers}
96
import org.sunbird.cassandra.CassandraConnector
10-
import org.sunbird.common.Platform
11-
import org.sunbird.graph.service.util.DriverUtil
127
import org.sunbird.graph.dac.model.Node
138
import org.sunbird.graph.schema.FrameworkMasterCategoryMap
149
import org.janusgraph.core.JanusGraph
1510
import org.janusgraph.core.JanusGraphFactory
16-
import java.lang.reflect.Field
11+
import org.testcontainers.containers.CassandraContainer
12+
1713
import java.util
1814
import scala.collection.JavaConverters._
1915

16+
/**
17+
* Singleton that manages a single shared Cassandra testcontainer for all test suites
18+
* in graph-engine_2.13. The container is started lazily on first access and is never
19+
* explicitly stopped — Testcontainers' Ryuk reaper handles teardown after the JVM exits.
20+
*/
21+
object CassandraTestSupport {
22+
23+
val container: CassandraContainer[_] = {
24+
val c = new CassandraContainer("cassandra:3.11")
25+
c.start()
26+
c
27+
}
28+
29+
private val cluster: Cluster =
30+
Cluster.builder()
31+
.addContactPoint(container.getHost)
32+
.withPort(container.getMappedPort(9042))
33+
.withoutJMXReporting()
34+
.withProtocolVersion(ProtocolVersion.V4)
35+
.build()
36+
37+
/** Open a new Session against the shared container cluster. */
38+
def newSession(): Session = cluster.connect()
39+
40+
/**
41+
* Inject the given session into CassandraConnector's private static sessionMap
42+
* under key "lp" so that CassandraConnector.getSession() returns our container
43+
* session instead of trying to reach a real Cassandra host.
44+
*/
45+
def injectIntoConnector(session: Session): Unit = {
46+
val field = classOf[CassandraConnector].getDeclaredField("sessionMap")
47+
field.setAccessible(true)
48+
val map = field.get(null).asInstanceOf[java.util.Map[String, Session]]
49+
map.put("lp", session)
50+
}
51+
}
52+
2053
class BaseSpec extends AsyncFlatSpec with Matchers with BeforeAndAfterAll {
2154

2255
var graph: JanusGraph = _
23-
var session: com.datastax.driver.core.Session = null
56+
var session: Session = null
2457
implicit val oec: OntologyEngineContext = new OntologyEngineContext
2558

2659
private val script_1 = "CREATE KEYSPACE IF NOT EXISTS content_store WITH replication = {'class': 'SimpleStrategy','replication_factor': '1'};"
@@ -51,16 +84,16 @@ class BaseSpec extends AsyncFlatSpec with Matchers with BeforeAndAfterAll {
5184
}
5285
}
5386

54-
def setUpEmbeddedCassandra(): Unit = {
55-
System.setProperty("cassandra.unsafesystem", "true")
56-
EmbeddedCassandraServerHelper.startEmbeddedCassandra("/cassandra-unit.yaml", 100000L)
87+
def setUpCassandraContainer(): Unit = {
88+
session = CassandraTestSupport.newSession()
89+
CassandraTestSupport.injectIntoConnector(session)
5790
}
5891

5992
var redisServer: RedisServer = _
6093

6194
override def beforeAll(): Unit = {
6295
setUpEmbeddedGraph()
63-
setUpEmbeddedCassandra()
96+
setUpCassandraContainer()
6497
setupRedis()
6598
setupGraphData()
6699
createRelationData()
@@ -71,9 +104,9 @@ class BaseSpec extends AsyncFlatSpec with Matchers with BeforeAndAfterAll {
71104
if (null != graph) {
72105
graph.close()
73106
}
74-
if(null != session && !session.isClosed)
107+
if (null != session && !session.isClosed)
75108
session.close()
76-
EmbeddedCassandraServerHelper.cleanEmbeddedCassandra()
109+
// Container is a singleton managed by Testcontainers' Ryuk reaper — do not stop it here.
77110
if (null != redisServer) {
78111
redisServer.stop()
79112
}
@@ -85,10 +118,10 @@ class BaseSpec extends AsyncFlatSpec with Matchers with BeforeAndAfterAll {
85118
}
86119

87120
def executeCassandraQuery(queries: String*): Unit = {
88-
if(null == session || session.isClosed){
121+
if (null == session || session.isClosed) {
89122
session = CassandraConnector.getSession
90123
}
91-
for(query <- queries) {
124+
for (query <- queries) {
92125
session.execute(query)
93126
}
94127
}
@@ -120,7 +153,7 @@ class BaseSpec extends AsyncFlatSpec with Matchers with BeforeAndAfterAll {
120153

121154

122155
def createVertex(label: String, properties: Map[String, AnyRef]): Unit = {
123-
val vertex = graph.asInstanceOf[org.janusgraph.core.JanusGraphTransaction].addVertex(org.apache.tinkerpop.gremlin.structure.T.label, label)
156+
val vertex = graph.addVertex(org.apache.tinkerpop.gremlin.structure.T.label, label)
124157
properties.foreach { case (k, v) => vertex.property(k, v) }
125158
}
126159

@@ -131,7 +164,7 @@ class BaseSpec extends AsyncFlatSpec with Matchers with BeforeAndAfterAll {
131164
graph.tx().commit()
132165
}
133166

134-
def createBulkNodes(): Unit ={
167+
def createBulkNodes(): Unit = {
135168
createVertex("domain", Map[String, AnyRef]("IL_UNIQUE_ID" -> "do_0000123", "identifier" -> "do_0000123", "graphId" -> "domain"))
136169
createVertex("domain", Map[String, AnyRef]("IL_UNIQUE_ID" -> "do_0000234", "identifier" -> "do_0000234", "graphId" -> "domain"))
137170
createVertex("domain", Map[String, AnyRef]("IL_UNIQUE_ID" -> "do_0000345", "identifier" -> "do_0000345", "graphId" -> "domain"))

‎ontology-engine/graph-engine_2.13/src/test/scala/org/sunbird/graph/nodes/TestDataNode.scala‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ import scala.concurrent.Future
1515
class TestDataNode extends BaseSpec {
1616

1717
override def createVertex(label: String, properties: Map[String, AnyRef]): Unit = {
18-
val vertex = graph.asInstanceOf[org.janusgraph.core.JanusGraphTransaction].addVertex(org.apache.tinkerpop.gremlin.structure.T.label, label)
18+
val vertex = graph.addVertex(org.apache.tinkerpop.gremlin.structure.T.label, label)
1919
properties.foreach { case (k, v) => vertex.property(k, v) }
2020
}
2121

‎ontology-engine/graph-engine_2.13/src/test/scala/org/sunbird/graph/utils/ScalaJsonUtilsTest.scala‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ import java.util
44

55
import com.fasterxml.jackson.databind.exc.{InvalidDefinitionException, MismatchedInputException}
66
import org.apache.commons.lang3.StringUtils
7-
import org.codehaus.jackson.JsonProcessingException
7+
import com.fasterxml.jackson.core.JsonProcessingException
88
import org.scalatest.{FlatSpec, Matchers}
99

1010
class ScalaJsonUtilsTest extends FlatSpec with Matchers {

‎platform-core/platform-common/pom.xml‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -57,18 +57,12 @@
5757
<dependency>
5858
<groupId>org.apache.poi</groupId>
5959
<artifactId>poi-ooxml</artifactId>
60-
<version>3.17</version>
61-
<exclusions>
62-
<exclusion>
63-
<groupId>org.apache.xmlbeans</groupId>
64-
<artifactId>xmlbeans</artifactId>
65-
</exclusion>
66-
</exclusions>
60+
<version>5.4.0</version>
6761
</dependency>
6862
<dependency>
6963
<groupId>org.apache.xmlbeans</groupId>
7064
<artifactId>xmlbeans</artifactId>
71-
<version>3.0.0</version>
65+
<version>5.2.1</version>
7266
</dependency>
7367
<dependency>
7468
<groupId>org.apache.commons</groupId>

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@
110110
<dependency>
111111
<groupId>org.apache.zookeeper</groupId>
112112
<artifactId>zookeeper</artifactId>
113-
<version>3.8.4</version>
113+
<version>3.8.6</version>
114114
</dependency>
115115
<dependency>
116116
<groupId>com.fasterxml.jackson.core</groupId>

0 commit comments

Comments
 (0)