You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
[Fix] Fix vulnerabilities in the present SDK version (#383)
## What changes are proposed in this pull request?
- **What** :
- Update commons.io to fix the [CVE in the present
version](https://mvnrepository.com/artifact/com.databricks/databricks-sdk-java/0.34.0).
Looks like depandabot PRs are no longer being created/merged.
[[Link](https://github.com/databricks/databricks-sdk-java/pull/261/files)]
- Change ini4j configuration because of vulnerability.
- **Why**
- ini4j 0.5.4 version has an infinite loop situation in the following
piece of code. This loop can cause excessive memory and CPU usage,
potentially crashing the application. Alternate libraries like Apache
Commons Configuration gracefully handle the situation (by limiting the
recursions internally). I will raise a PR on SDK later today to replace
the ini4j library. Moreover : the official site of ini4j [is up for
sale](http://www.ini4j.org/) and the last update to this maven package
was done in [2015](https://mvnrepository.com/artifact/org.ini4j/ini4j).
There is no reason we should continue to use this package.
```
Ini ini = new Ini();
ini.load(new ByteArrayInputStream("""
[deploy]
a = ${test/a}
b = ${doc/b}
[test]
a = ${deploy/a}
b = ${deploy/b}
[doc]
a = 15
b = 45
""".getBytes(StandardCharsets.UTF_8)));
// Will cause stack overflow
ini.get("deploy").fetch("a");
```
## How is this tested?
- The existing unit tests run fine.
0 commit comments