Skip to content

MLE-23227 - Force v3.18 of commons-lang to fix CVE #203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 5, 2025
Merged

MLE-23227 - Force v3.18 of commons-lang to fix CVE #203

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ In the Control Center GUI, you can verify the MarkLogic Kafka connector instance
3. Click on the "marklogic-purchases-sink" connector

You can then verify that data is being written to MarkLogic by using MarkLogic's qconsole application to inspect the
contents of the `kafka-test-content` database.
contents of the `data-hub-FINAL` database.
Copy link

Copilot AI Aug 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR title indicates this change is about forcing commons-lang v3.18 to fix a CVE, but the only visible change is a database name correction in documentation. This creates confusion about the actual purpose of the PR. Consider updating the PR title to reflect the documentation fix, or ensure the dependency changes are included in the diff.

Copilot uses AI. Check for mistakes.
Copy link
Contributor

@rjrudin rjrudin Aug 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this because we switched the test-app to be a DHF test app? If so, there are a few more references to "kafka-test-content" in the codebase to change.


### Load a MarkLogic Kafka source connector instance
You can also load an instance of the MarkLogic Kafka source connector that will read rows from the `demo/purchases`
Expand Down
8 changes: 8 additions & 0 deletions build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,14 @@ repositories {
configurations {
documentation
assets

// Force v3.18 of commons-lang3 to avoid security vulnerabilities, without also
// upgrading ml-app-deployer to 6.0.0, which we are not ready to do yet.
configurations.all {
resolutionStrategy {
force 'org.apache.commons:commons-lang3:3.18.0'
}
}
}

ext {
Expand Down
61 changes: 32 additions & 29 deletions src/test/java/com/marklogic/kafka/connect/source/debug/InsertAuthorsTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,41 +34,44 @@
import static org.junit.jupiter.api.Assertions.assertTrue;

/**
* Convenience program for inserting a new author into the kafka-test-content database to facilitate testing the
* source connector on the authors TDE. This reuses the test plumbing so we don't have to collect host/port/etc
* information, but it adjusts the DatabaseClient config to use port 8018 instead of 8019 so that documents are
* inserted into the kafka-test-content database instead of kafka-test-test-content.
* Convenience program for inserting a new author into the data-hub-STAGING
* database to facilitate testing the
* source connector on the authors TDE. This reuses the test plumbing so we
* don't have to collect host/port/etc
* information, but it adjusts the DatabaseClient config to use port 8010
* instead of 8011 so that documents are
* inserted into the data-hub-STAGING database instead of data-hub-FINAL.
*/
class InsertAuthorsTest extends AbstractIntegrationTest {

// Only intended for inserting new authors with a user-provided ID. Can easily expand this to make the data more
// random and/or controlled by the user.
private final static String CITATIONS_DOC = "<Citations>\n" +
" <Citation>\n" +
" <ID>%%AUTHOR_ID%%</ID>\n" +
" <Article>\n" +
" <Journal>\n" +
" <ISSN>61296-004</ISSN>\n" +
" <JournalIssue>\n" +
" <Volume>44</Volume>\n" +
" <PubDate>\n" +
" <Date>2022-07-13</Date>\n" +
" <Year>2022</Year>\n" +
" <Month>07</Month>\n" +
" <Day>13</Day>\n" +
" <Time>09:00:00</Time>\n" +
" </PubDate>\n" +
" </JournalIssue>\n" +
" </Journal>\n" +
" <AuthorList>\n" +
" <Author>\n" +
" <LastName>LastName%%AUTHOR_ID%%</LastName>\n" +
" <ForeName>ForeName%%AUTHOR_ID%%</ForeName>\n" +
" </Author>\n" +
" </AuthorList>\n" +
" </Article>\n" +
" </Citation>\n" +
"</Citations>\n";
" <Citation>\n" +
" <ID>%%AUTHOR_ID%%</ID>\n" +
" <Article>\n" +
" <Journal>\n" +
" <ISSN>61296-004</ISSN>\n" +
" <JournalIssue>\n" +
" <Volume>44</Volume>\n" +
" <PubDate>\n" +
" <Date>2022-07-13</Date>\n" +
" <Year>2022</Year>\n" +
" <Month>07</Month>\n" +
" <Day>13</Day>\n" +
" <Time>09:00:00</Time>\n" +
" </PubDate>\n" +
" </JournalIssue>\n" +
" </Journal>\n" +
" <AuthorList>\n" +
" <Author>\n" +
" <LastName>LastName%%AUTHOR_ID%%</LastName>\n" +
" <ForeName>ForeName%%AUTHOR_ID%%</ForeName>\n" +
" </Author>\n" +
" </AuthorList>\n" +
" </Article>\n" +
" </Citation>\n" +
"</Citations>\n";

@Autowired
SimpleTestConfig testConfig;
Expand Down
2 changes: 1 addition & 1 deletion test-app/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ task loadMarkLogicEmployeesSourceConnector(type: Exec) {
task insertAuthors(type: Test) {
useJUnitPlatform()
systemProperty "AUTHOR_IDS", authorIds
description = "Insert a new author into the kafka-test-content database via a new citations XML document; " +
description = "Insert a new author into the data-hub-STAGING database via a new citations XML document; " +
"use e.g. -PauthorIds=7,8,9 to insert 3 new authors with IDs of 7, 8, and 9"
include "com/marklogic/kafka/connect/source/debug/InsertAuthorsTest.class"
}
Expand Down