Skip to content

Commit a5e12fd

Browse files
ShahimSharafudeenShahimSharafudeen
authored
fix(security): Upgrade druid version to 35.0.1 (#26820)
## Description Upgrade **druid** to version 35.0.1 to address CVE-2024-53990 and CVE-2025-12183 Since the CVE fixes for lz4-java and Rhino are not included in Druid 35.0.1, we resolved the vulnerabilities by upgrading the corresponding transitive dependencies. Upgrade **lz4-java** to version 1.10.2 to address CVE-2025-66566 Upgrade **rhino** to version 1.8.1 to address CVE-2025-66453 ## Motivation and Context <!---Why is this change required? What problem does it solve?--> <!---If it fixes an open issue, please link to the issue here.--> ## Impact <!---Describe any public API or user-facing feature change or any performance impact--> ## Test Plan Tested in Local : ``` presto> show tables from druid.wikipedia; Query 20260101_125243_00001_dkgk2, RUNNING, 1 node, 19 splits Query 20260101_125243_00001_dkgk2, RUNNING, 1 node, 19 splits Query 20260101_125243_00001_dkgk2, RUNNING, 1 node, 19 splits Table ----------------- car_details employee employee_data employee_druid2 inline_data kttm1 order_details product_table sales_report student_details wikipedia (11 rows) Query 20260101_125243_00001_dkgk2, FINISHED, 1 node Splits: 19 total, 19 done (100.00%) [Latency: client-side: 0:07, server-side: 0:07] [11 rows, 334B] [1 rows/s, 49B/s] presto> select * from druid.wikipedia.employee_data limit 10; __time | employee_id | name | department | salary -------------------------+-------------+-----------------+-------------+-------- 2010-01-01 05:30:00.000 | 101 | John Doe | Marketing | 60000 2010-01-01 05:30:00.000 | 102 | Jane Smith | Sales | 70000 2010-01-01 05:30:00.000 | 103 | Michael Johnson | Engineering | 80000 2010-01-01 05:30:00.000 | 104 | Emily Davis | Finance | 75000 (4 rows) Query 20260101_125342_00002_dkgk2, FINISHED, 1 node Splits: 17 total, 17 done (100.00%) [Latency: client-side: 0:03, server-side: 0:03] [4 rows, 224B] [1 rows/s, 85B/s] presto> select * from druid.wikipedia.employee_data limit 3; __time | employee_id | name | department | salary -------------------------+-------------+-----------------+-------------+-------- 2010-01-01 05:30:00.000 | 101 | John Doe | Marketing | 60000 2010-01-01 05:30:00.000 | 102 | Jane Smith | Sales | 70000 2010-01-01 05:30:00.000 | 103 | Michael Johnson | Engineering | 80000 (3 rows) Query 20260101_125409_00003_dkgk2, FINISHED, 1 node Splits: 17 total, 17 done (100.00%) [Latency: client-side: 0:02, server-side: 0:02] [3 rows, 169B] [1 rows/s, 78B/s] ``` ## Contributor checklist - [ ] Please make sure your submission complies with our [contributing guide](https://github.com/prestodb/presto/blob/master/CONTRIBUTING.md), in particular [code style](https://github.com/prestodb/presto/blob/master/CONTRIBUTING.md#code-style) and [commit standards](https://github.com/prestodb/presto/blob/master/CONTRIBUTING.md#commit-standards). - [ ] PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced. - [ ] Documented new properties (with its default value), SQL syntax, functions, or other functionality. - [ ] If release notes are required, they follow the [release notes guidelines](https://github.com/prestodb/presto/wiki/Release-Notes-Guidelines). - [ ] Adequate tests were added if applicable. - [ ] CI passed. - [ ] If adding new dependencies, verified they have an [OpenSSF Scorecard](https://securityscorecards.dev/#the-checks) score of 5.0 or higher (or obtained explicit TSC approval for lower scores). ## Release Notes Please follow [release notes guidelines](https://github.com/prestodb/presto/wiki/Release-Notes-Guidelines) and fill in the release notes below. ``` == RELEASE NOTES == Security Changes * Upgrade Druid to version 35.0.1 to address `CVE-2024-53990 <https://github.com/advisories/GHSA-mfj5-cf8g-g2fv>`_ and `CVE-2025-12183 <https://github.com/advisories/GHSA-vqf4-7m7x-wgfc>`_. * Upgrade lz4-java to version 1.10.2 to address `CVE-2025-66566 <https://github.com/advisories/GHSA-cmp6-m4wj-q63q>`_. * Upgrade Rhino to version 1.8.1 to address `CVE-2025-66453 <https://github.com/advisories/GHSA-3w8q-xq97-5j7x>`_. ```
1 parent 69b959d commit a5e12fd

File tree

4 files changed

+193
-10
lines changed

4 files changed

+193
-10
lines changed

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@
6767
<dep.slf4j.version>2.0.16</dep.slf4j.version>
6868
<dep.kafka.version>3.9.1</dep.kafka.version>
6969
<dep.pinot.version>1.3.0</dep.pinot.version>
70-
<dep.druid.version>30.0.1</dep.druid.version>
70+
<dep.druid.version>35.0.1</dep.druid.version>
7171
<dep.jaxb.version>2.3.1</dep.jaxb.version>
7272
<dep.jaxb.runtime.version>4.0.6</dep.jaxb.runtime.version>
7373
<dep.hudi.version>0.14.0</dep.hudi.version>

‎presto-druid/pom.xml‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@
3232
<dependencyManagement>
3333
<dependencies>
3434
<dependency>
35-
<groupId>org.hibernate</groupId>
35+
<groupId>org.hibernate.validator</groupId>
3636
<artifactId>hibernate-validator</artifactId>
3737
<version>8.0.3.Final</version>
3838
</dependency>
@@ -41,6 +41,16 @@
4141
<artifactId>jakarta.el</artifactId>
4242
<version>4.0.1</version>
4343
</dependency>
44+
<dependency>
45+
<groupId>at.yawk.lz4</groupId>
46+
<artifactId>lz4-java</artifactId>
47+
<version>1.10.2</version>
48+
</dependency>
49+
<dependency>
50+
<groupId>org.mozilla</groupId>
51+
<artifactId>rhino</artifactId>
52+
<version>1.8.1</version>
53+
</dependency>
4454
</dependencies>
4555
</dependencyManagement>
4656

‎presto-druid/src/main/java/com/facebook/presto/druid/segment/PrestoQueryableIndex.java‎

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
/*
2+
* Licensed under the Apache License, Version 2.0 (the "License");
3+
* you may not use this file except in compliance with the License.
4+
* You may obtain a copy of the License at
5+
*
6+
* http://www.apache.org/licenses/LICENSE-2.0
7+
*
8+
* Unless required by applicable law or agreed to in writing, software
9+
* distributed under the License is distributed on an "AS IS" BASIS,
10+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
* See the License for the specific language governing permissions and
12+
* limitations under the License.
13+
*/
14+
package com.facebook.presto.druid.segment;
15+
16+
import com.google.common.annotations.VisibleForTesting;
17+
import com.google.common.base.Preconditions;
18+
import com.google.common.base.Supplier;
19+
import com.google.common.base.Suppliers;
20+
import com.google.common.collect.ImmutableList;
21+
import com.google.common.collect.Maps;
22+
import org.apache.druid.collections.bitmap.BitmapFactory;
23+
import org.apache.druid.java.util.common.io.smoosh.SmooshedFileMapper;
24+
import org.apache.druid.query.OrderBy;
25+
import org.apache.druid.segment.DimensionHandler;
26+
import org.apache.druid.segment.Metadata;
27+
import org.apache.druid.segment.QueryableIndex;
28+
import org.apache.druid.segment.column.BaseColumnHolder;
29+
import org.apache.druid.segment.column.ColumnHolder;
30+
import org.apache.druid.segment.data.Indexed;
31+
import org.joda.time.Interval;
32+
33+
import javax.annotation.Nullable;
34+
35+
import java.util.Collections;
36+
import java.util.List;
37+
import java.util.Map;
38+
39+
public class PrestoQueryableIndex
40+
implements QueryableIndex
41+
{
42+
private final Interval dataInterval;
43+
private final List<String> columnNames;
44+
private final Indexed<String> availableDimensions;
45+
private final BitmapFactory bitmapFactory;
46+
private final Map<String, Supplier<ColumnHolder>> columns;
47+
private final SmooshedFileMapper fileMapper;
48+
@Nullable
49+
private final Metadata metadata;
50+
private final Supplier<Map<String, DimensionHandler>> dimensionHandlers;
51+
52+
public PrestoQueryableIndex(
53+
Interval dataInterval,
54+
Indexed<String> dimNames,
55+
BitmapFactory bitmapFactory,
56+
Map<String, Supplier<ColumnHolder>> columns,
57+
SmooshedFileMapper fileMapper,
58+
@Nullable Metadata metadata,
59+
boolean lazy)
60+
{
61+
Preconditions.checkNotNull(columns.get(ColumnHolder.TIME_COLUMN_NAME));
62+
this.dataInterval = Preconditions.checkNotNull(dataInterval, "dataInterval");
63+
ImmutableList.Builder<String> columnNamesBuilder = ImmutableList.builder();
64+
for (String column : columns.keySet()) {
65+
if (!ColumnHolder.TIME_COLUMN_NAME.equals(column)) {
66+
columnNamesBuilder.add(column);
67+
}
68+
}
69+
this.columnNames = columnNamesBuilder.build();
70+
this.availableDimensions = dimNames;
71+
this.bitmapFactory = bitmapFactory;
72+
this.columns = columns;
73+
this.fileMapper = fileMapper;
74+
this.metadata = metadata;
75+
76+
if (lazy) {
77+
this.dimensionHandlers = Suppliers.memoize(() -> initDimensionHandlers(availableDimensions));
78+
}
79+
else {
80+
this.dimensionHandlers = () -> initDimensionHandlers(availableDimensions);
81+
}
82+
}
83+
84+
@Override
85+
public Interval getDataInterval()
86+
{
87+
return dataInterval;
88+
}
89+
90+
@Override
91+
public int getNumRows()
92+
{
93+
return columns.get(ColumnHolder.TIME_COLUMN_NAME).get().getLength();
94+
}
95+
96+
@Override
97+
public List<String> getColumnNames()
98+
{
99+
return columnNames;
100+
}
101+
102+
@Override
103+
public Indexed<String> getAvailableDimensions()
104+
{
105+
return availableDimensions;
106+
}
107+
108+
@Override
109+
public BitmapFactory getBitmapFactoryForDimensions()
110+
{
111+
return bitmapFactory;
112+
}
113+
114+
@Nullable
115+
@Override
116+
public BaseColumnHolder getColumnHolder(String columnName)
117+
{
118+
Supplier<BaseColumnHolder> columnHolderSupplier = (Supplier) this.columns.get(columnName);
119+
return columnHolderSupplier == null ? null : (BaseColumnHolder) columnHolderSupplier.get();
120+
}
121+
122+
@VisibleForTesting
123+
public Map<String, Supplier<ColumnHolder>> getColumns()
124+
{
125+
return columns;
126+
}
127+
128+
@VisibleForTesting
129+
public SmooshedFileMapper getFileMapper()
130+
{
131+
return fileMapper;
132+
}
133+
134+
@Override
135+
public void close()
136+
{
137+
if (fileMapper != null) {
138+
fileMapper.close();
139+
}
140+
}
141+
142+
@Override
143+
public Metadata getMetadata()
144+
{
145+
return metadata;
146+
}
147+
148+
@Override
149+
public List<OrderBy> getOrdering()
150+
{
151+
return Collections.emptyList();
152+
}
153+
154+
@Override
155+
public Map<String, DimensionHandler> getDimensionHandlers()
156+
{
157+
return dimensionHandlers.get();
158+
}
159+
160+
private Map<String, DimensionHandler> initDimensionHandlers(Indexed<String> availableDimensions)
161+
{
162+
Map<String, DimensionHandler> dimensionHandlerMap = Maps.newLinkedHashMap();
163+
for (String dim : availableDimensions) {
164+
final ColumnHolder columnHolder = getColumnHolder(dim);
165+
final DimensionHandler handler = columnHolder.getColumnFormat().getColumnHandler(dim);
166+
dimensionHandlerMap.put(dim, handler);
167+
}
168+
return dimensionHandlerMap;
169+
}
170+
}

‎presto-druid/src/main/java/com/facebook/presto/druid/segment/V9SegmentIndexSource.java‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,11 @@
2222
import com.fasterxml.jackson.databind.ObjectMapper;
2323
import com.google.common.base.Supplier;
2424
import com.google.common.collect.Streams;
25-
import org.apache.druid.common.config.NullHandling;
2625
import org.apache.druid.common.utils.SerializerUtils;
2726
import org.apache.druid.jackson.DefaultObjectMapper;
2827
import org.apache.druid.java.util.common.Intervals;
2928
import org.apache.druid.segment.Metadata;
3029
import org.apache.druid.segment.QueryableIndex;
31-
import org.apache.druid.segment.SimpleQueryableIndex;
3230
import org.apache.druid.segment.column.ColumnConfig;
3331
import org.apache.druid.segment.column.ColumnDescriptor;
3432
import org.apache.druid.segment.column.ColumnHolder;
@@ -66,18 +64,18 @@ public class V9SegmentIndexSource
6664
public V9SegmentIndexSource(SegmentColumnSource segmentColumnSource)
6765
{
6866
this.segmentColumnSource = requireNonNull(segmentColumnSource, "segmentColumnSource is null");
69-
NullHandling.initializeForTests();
7067
}
7168

7269
@Override
7370
public QueryableIndex loadIndex(List<ColumnHandle> columnHandles)
7471
throws IOException
7572
{
7673
ByteBuffer indexBuffer = ByteBuffer.wrap(segmentColumnSource.getColumnData(INDEX_METADATA_FILE_NAME));
77-
GenericIndexed.read(indexBuffer, STRING_STRATEGY);
74+
GenericIndexed.read(indexBuffer, STRING_STRATEGY, null);
7875
GenericIndexed<String> allDimensions = GenericIndexed.read(
7976
indexBuffer,
80-
STRING_STRATEGY);
77+
STRING_STRATEGY,
78+
null);
8179

8280
Interval dataInterval = Intervals.utc(indexBuffer.getLong(), indexBuffer.getLong());
8381

@@ -114,8 +112,13 @@ public QueryableIndex loadIndex(List<ColumnHandle> columnHandles)
114112
columns.put(TIME_COLUMN_NAME, () -> createColumnHolder(TIME_COLUMN_NAME));
115113

116114
Indexed<String> indexed = new ListIndexed<>(availableDimensions);
117-
// TODO: get rid of the time column by creating Presto's SimpleQueryableIndex impl
118-
return new SimpleQueryableIndex(
115+
/*
116+
* Druid 35.0.1 made SimpleQueryableIndex abstract, so created PrestoQueryableIndex
117+
* based on the original implementation.
118+
* TODO: Refactor PrestoQueryableIndex to remove the dependency on the __time column
119+
* and implement a fully Presto-specific QueryableIndex.
120+
*/
121+
return new PrestoQueryableIndex(
119122
dataInterval,
120123
indexed,
121124
segmentBitmapSerdeFactory.getBitmapFactory(),
@@ -136,7 +139,7 @@ private ColumnHolder createColumnHolder(String columnName)
136139
try {
137140
ByteBuffer columnData = ByteBuffer.wrap(segmentColumnSource.getColumnData(columnName));
138141
ColumnDescriptor columnDescriptor = readColumnDescriptor(columnData);
139-
return columnDescriptor.read(columnData, ColumnConfig.DEFAULT, null);
142+
return columnDescriptor.read(columnData, ColumnConfig.DEFAULT, null, null);
140143
}
141144
catch (IOException e) {
142145
throw new PrestoException(DRUID_SEGMENT_LOAD_ERROR, e);

0 commit comments

Comments
 (0)