Skip to content

Commit ef60c8f

Browse files
committed
Update guava to 33.3.1-jre
It fixes ~8 vulnurabilities that comming from guava dependency.
1 parent 11f6af2 commit ef60c8f

File tree

3 files changed

+8
-107
lines changed

3 files changed

+8
-107
lines changed

driver-core/src/main/java/com/datastax/driver/core/GuavaCompatibility.java

Lines changed: 5 additions & 104 deletions
Original file line numberDiff line numberDiff line change
@@ -17,32 +17,23 @@
1717

1818
import com.datastax.driver.core.exceptions.DriverInternalError;
1919
import com.google.common.base.Function;
20-
import com.google.common.collect.BiMap;
21-
import com.google.common.collect.Maps;
2220
import com.google.common.net.HostAndPort;
2321
import com.google.common.reflect.TypeToken;
2422
import com.google.common.util.concurrent.AsyncFunction;
2523
import com.google.common.util.concurrent.FutureCallback;
2624
import com.google.common.util.concurrent.Futures;
2725
import com.google.common.util.concurrent.ListenableFuture;
2826
import com.google.common.util.concurrent.MoreExecutors;
29-
import java.lang.reflect.ParameterizedType;
30-
import java.lang.reflect.Type;
31-
import java.util.Map;
3227
import java.util.concurrent.Executor;
3328
import org.slf4j.Logger;
3429
import org.slf4j.LoggerFactory;
3530

3631
/**
3732
* A compatibility layer to support a wide range of Guava versions.
3833
*
39-
* <p>The driver is compatible with Guava 16.0.1 or higher, but Guava 20 introduced incompatible
40-
* breaking changes in its API, that could in turn be breaking for legacy driver clients if we
41-
* simply upgraded our dependency. We don't want to increment our major version "just" for Guava (we
42-
* have other changes planned).
34+
* <p>The driver is compatible with Guava 19.0 or higher.
4335
*
44-
* <p>Therefore we depend on Guava 19, which has both the deprecated and the new APIs, and detect
45-
* the actual version at runtime in order to call the relevant methods.
36+
* <p>We detect the actual version at runtime in order to call the relevant methods.
4637
*
4738
* <p>This is a hack, and might not work with subsequent Guava releases; the real fix is to stop
4839
* exposing Guava in our public API. We'll address that in version 4 of the driver.
@@ -188,84 +179,18 @@ public abstract <I, O> ListenableFuture<O> transformAsync(
188179
* <p>The method {@code HostAndPort.getHostText} has been replaced with {@code
189180
* HostAndPort.getHost} starting with Guava 20.0; it has been completely removed in Guava 22.0.
190181
*/
191-
@SuppressWarnings("JavaReflectionMemberAccess")
192182
public String getHost(HostAndPort hostAndPort) {
193-
try {
194-
// Guava >= 20.0
195-
return (String) HostAndPort.class.getMethod("getHost").invoke(hostAndPort);
196-
} catch (Exception e) {
197-
// Guava < 22.0
198-
return hostAndPort.getHostText();
199-
}
183+
// Guava >= 20.0
184+
return hostAndPort.getHost();
200185
}
201186

202187
private static GuavaCompatibility selectImplementation() {
203188
if (isGuava_19_0_OrHigher()) {
204189
logger.info("Detected Guava >= 19 in the classpath, using modern compatibility layer");
205190
return new Version19OrHigher();
206-
} else if (isGuava_16_0_1_OrHigher()) {
207-
logger.info("Detected Guava < 19 in the classpath, using legacy compatibility layer");
208-
return new Version18OrLower();
209191
} else {
210192
throw new DriverInternalError(
211-
"Detected incompatible version of Guava in the classpath. "
212-
+ "You need 16.0.1 or higher.");
213-
}
214-
}
215-
216-
private static class Version18OrLower extends GuavaCompatibility {
217-
218-
@Override
219-
public <V> ListenableFuture<V> withFallback(
220-
ListenableFuture<? extends V> input, final AsyncFunction<Throwable, V> fallback) {
221-
return Futures.withFallback(
222-
input,
223-
new com.google.common.util.concurrent.FutureFallback<V>() {
224-
@Override
225-
public ListenableFuture<V> create(Throwable t) throws Exception {
226-
return fallback.apply(t);
227-
}
228-
});
229-
}
230-
231-
@Override
232-
public <V> ListenableFuture<V> withFallback(
233-
ListenableFuture<? extends V> input,
234-
final AsyncFunction<Throwable, V> fallback,
235-
Executor executor) {
236-
return Futures.withFallback(
237-
input,
238-
new com.google.common.util.concurrent.FutureFallback<V>() {
239-
@Override
240-
public ListenableFuture<V> create(Throwable t) throws Exception {
241-
return fallback.apply(t);
242-
}
243-
},
244-
executor);
245-
}
246-
247-
@Override
248-
public <I, O> ListenableFuture<O> transformAsync(
249-
ListenableFuture<I> input, AsyncFunction<? super I, ? extends O> function) {
250-
return Futures.transform(input, function);
251-
}
252-
253-
@Override
254-
public <I, O> ListenableFuture<O> transformAsync(
255-
ListenableFuture<I> input,
256-
AsyncFunction<? super I, ? extends O> function,
257-
Executor executor) {
258-
return Futures.transform(input, function, executor);
259-
}
260-
261-
@Override
262-
public boolean isSupertypeOf(TypeToken<?> target, TypeToken<?> argument) {
263-
return target.isAssignableFrom(argument);
264-
}
265-
266-
@Override
267-
public Executor sameThreadExecutor() {
268-
return MoreExecutors.sameThreadExecutor();
193+
"Detected incompatible version of Guava in the classpath. " + "You need 19.0 or higher.");
269194
}
270195
}
271196

@@ -319,30 +244,6 @@ private static boolean isGuava_19_0_OrHigher() {
319244
Executor.class);
320245
}
321246

322-
private static boolean isGuava_16_0_1_OrHigher() {
323-
// Cheap check for < 16.0
324-
if (!methodExists(Maps.class, "asConverter", BiMap.class)) {
325-
return false;
326-
}
327-
// More elaborate check to filter out 16.0, which has a bug in TypeToken. We need 16.0.1.
328-
boolean resolved = false;
329-
TypeToken<Map<String, String>> mapOfString = TypeTokens.mapOf(String.class, String.class);
330-
Type type = mapOfString.getType();
331-
if (type instanceof ParameterizedType) {
332-
ParameterizedType pType = (ParameterizedType) type;
333-
Type[] types = pType.getActualTypeArguments();
334-
if (types.length == 2) {
335-
TypeToken valueType = TypeToken.of(types[1]);
336-
resolved = valueType.getRawType().equals(String.class);
337-
}
338-
}
339-
if (!resolved) {
340-
logger.debug(
341-
"Detected Guava issue #1635 which indicates that version 16.0 is in the classpath");
342-
}
343-
return resolved;
344-
}
345-
346247
private static boolean methodExists(
347248
Class<?> declaringClass, String methodName, Class<?>... parameterTypes) {
348249
try {

driver-core/src/test/java/com/datastax/driver/core/AbstractReconnectionHandlerTest.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -263,7 +263,7 @@ public void should_yield_to_another_running_handler() {
263263
*/
264264
@Test(groups = "unit")
265265
public void should_yield_to_another_handler_that_just_succeeded() {
266-
future.set(Futures.immediateCheckedFuture(null));
266+
future.set(Futures.immediateFuture(null));
267267

268268
handler.start();
269269

pom.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@
5555
<log4j.version>1.2.17</log4j.version>
5656
<slf4j.version>1.7.36</slf4j.version>
5757
<slf4j-log4j12.version>1.7.36</slf4j-log4j12.version>
58-
<guava.version>19.0</guava.version>
58+
<guava.version>33.3.1-jre</guava.version>
5959
<netty.version>4.1.127.Final</netty.version>
6060
<netty-tcnative.artifact>netty-tcnative-boringssl-static</netty-tcnative.artifact>
6161
<netty-tcnative.version>2.0.70.Final</netty-tcnative.version>
@@ -543,7 +543,7 @@
543543
</additionalJOptions>
544544
<detectJavaApiLink>true</detectJavaApiLink>
545545
<links>
546-
<link>https://google.github.io/guava/releases/19.0/api/docs/</link>
546+
<link>https://google.github.io/guava/releases/33.3.1-jre/api/docs/</link>
547547
<link>http://netty.io/4.0/api/</link>
548548
<link>http://www.joda.org/joda-time/apidocs/</link>
549549
<link>http://fasterxml.github.io/jackson-core/javadoc/2.8/</link>

0 commit comments

Comments
 (0)