| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
| |
Change-Id: I946886eabb8e82b53bf78b712dee1e6dffae0e9e
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This reverts commit fcc90699fdec17b941a473221d228c832a533fc0.
Reason for revert: Security vulnerability for OAuth and OpenID auth
schemes.
OAuth and OpenID authentication schemes support multiple identity
providers, e.g.: CAS-OAuth2 and GitHub-OAuth2. An attacker can easily
impersonate existing Gerrit user by creating account on a different
provider with exactly the same username as the existing Gerrit account.
Instead of creating a fresh new user, the new account is erroneously
linked to the existing Gerrit account, even though, account linking
feature was not triggered from the Gerrit UI.
The original commit tried to fix intermittent database corruption
problem, with missing record in the database, in the context of single
identity provider (LDAP) where such problem doesn't exist, as there is
no way that one single username can belong to physical different users.
Nevertheless, there should be found another workaround, as trying to
recover on the fly and introducing severe security breach for other auth
schemes supported in Gerrit.
If all else fails, the missing database record has to be inserted
manually and the corresponding account must be re-indexed.
Bug: Issue 7652
Bug: Issue 10242
Change-Id: Icba3452c153b2ae3cc1a4ebc569342641f38c07c
|
| |
|
|
|
|
|
|
|
|
|
| |
This release fixes an issue where AdvertiseRefsHook was not called for
git-upload-pack in protocol v0 bidirectional transports, meaning that
wants aren't validated and a user can fetch anything that is pointed
to by any ref (using fetch-by-sha1), as long as they can guess the
object name.
Bug: Issue 10262
Change-Id: I8b81336acffc655f8d768ba84c8b95a086397b32
|
| |
|
|
| |
Change-Id: Ida1d56b8dd9a78fe4f0787aada9ac327be79f5ad
|
| |\
| |
| |
| |
| |
| |
| | |
* stable-2.13:
Upgrade JGit to 4.5.5.201812240535-r
Change-Id: I1a12308ffce77cbd519f246cad5098e8466f354b
|
| | |\
| | |
| | |
| | |
| | |
| | |
| | | |
* stable-2.12:
Upgrade JGit to 4.5.5.201812240535-r
Change-Id: Ie163ef97fa2c3b12eef720774e7cf333e02e3a49
|
| | | |\
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
* stable-2.11:
Upgrade JGit to 4.5.5.201812240535-r
Change-Id: I2f3bce590b9ddbd3a66ae070c125680ea8243eca
|
| | | | |\
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
* stable-2.10:
Upgrade JGit to 4.5.5.201812240535-r
Change-Id: Ie7d0263ced0db87079bb4ed061febc4b866a6e22
|
| | | | | |\
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
* stable-2.9:
Upgrade JGit to 4.5.5.201812240535-r
Change-Id: Iccd292df6484376463f5955b085d9d18dca271f1
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
This release fixes an issue where AdvertiseRefsHook was not called for
git-upload-pack in protocol v0 bidirectional transports, meaning that
wants aren't validated and a user can fetch anything that is pointed
to by any ref (using fetch-by-sha1), as long as they can guess the
object name.
Bug: Issue 10262
Change-Id: I5c1af5c7c549e1796fe6347c1ec08797471393a1
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
This fixes buildifier warnings that were not fixed in automatic
mode:
$ find . \( -name BUILD -o -name "*.bzl" \) -print \
| xargs buildifier --lint=warn
* Remove unused variables
* Pattern `src/test/java/com/google/gerrit/server/project/Util.java`
has no wildcard ('*')
* All calls to rules or macros should pass arguments by keyword
(arg_name=value) syntax
* ctx.new_file is deprecated, used ctx.actions.declare_file instead
Change-Id: I1f8a04e8d576ab637ba8a46118720218ec486fff
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
$ buildifier --version
buildifier version: 0.20.0
buildifier scm revision: db073457c5a56d810e46efc18bb93a4fd7aa7b5e
Change-Id: Ia14bf16aa6e61ea58645a379da2a871ca3d40d0d
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
In recent buildifier versions, lint errors can be fixed automatically:
$ find . \( -name BUILD -o -name "*.bzl" \) -print \
| xargs buildifier --lint=fix
This commit was created with Buildifier version 0.19.2:
$ buildifier --version
buildifier version: 0.19.2
buildifier scm revision: d39e4d5c25111527369142f16cdb49aa67707313
Change-Id: I1f06cd4596e794981ccc2d9fc2d1da9b17f3973a
|
| |\ \ \ \ \ \ |
|
| |/| | | | | |
| |/ / / / /
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
* stable-2.13:
Update JGit to latest 4.5.x release
Update JGit to latest 4.5.x release
Resource exhausted because of unclosed LDAP connection
Change-Id: I9f19c11ecb16b771b583b33696358087e5e0dae3
Signed-off-by: Edwin Kempin <ekempin@google.com>
|
| | |\ \ \ \ \ |
|
| | |/| | | | |
| | |/ / / /
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
* stable-2.12:
Update JGit to latest 4.5.x release
Update JGit to latest 4.5.x release
Resource exhausted because of unclosed LDAP connection
Change-Id: I78739a139022014d333bfbc4a708bd84ee3f7e15
Signed-off-by: Edwin Kempin <ekempin@google.com>
|
| | | |\| | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
* stable-2.11:
Update JGit to latest 4.5.x release
Resource exhausted because of unclosed LDAP connection
Change-Id: I126c4c5714f29f3e552caa0d415dcca13981ffc6
Signed-off-by: Edwin Kempin <ekempin@google.com>
|
| | | | |\| |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
* stable-2.10:
Update JGit to latest 4.5.x release
Resource exhausted because of unclosed LDAP connection
Change-Id: I1e07c7f8e2e4d08e0a06a5bb5dab6873408050c3
Signed-off-by: Edwin Kempin <ekempin@google.com>
|
| | | | | |\|
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
* stable-2.9:
Update JGit to latest 4.5.x release
Resource exhausted because of unclosed LDAP connection
Change-Id: I85cdc1fec9689d34ebbcb19d92484a90baf169e9
Signed-off-by: Edwin Kempin <ekempin@google.com>
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
JGit releases older than 4.5 are known to be prone to issues
with MissingObjectExceptions.
Since this is a major JGit version upgrade some code needs to be adapted
to changed JGit API.
Change-Id: Ia9099a5ac8fcbaf873e3354b5a47d2178c97444a
Signed-off-by: Edwin Kempin <ekempin@google.com>
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
When auth.type is set to LDAP (not LDAP_BIND), there will be two ldap
connections. The 1st connection will bind LDAP to find the DN of the
login user, and this connection will be closed in the try...finally
block. But the 2nd LDAP connection used to validate user password
is not closed at all. Too much unclosed TCP connections cause resource
exhausted and latter LDAP authentication will fail.
Change-Id: Ia5d83cccde8a0e6590d3e2fadc638d67f6e300e8
Reported-by: Wang Yiming <youthdragon.wangyiming@huawei.com>
Signed-off-by: Jiang Xin <worldhello.net@gmail.com>
(cherry picked from commit 7ac03844b38b7682b16d6b4ae701d410f84b18fe)
|
| | | |\| | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
* stable-2.11:
Update JGit to latest 4.5.x release
Change-Id: Ie471b38201b0b9a77e7aa7f40063e2d666fcd8d3
Signed-off-by: Edwin Kempin <ekempin@google.com>
|
| | | | |\| |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
* stable-2.10:
Update JGit to latest 4.5.x release
One test assertion had to be adapted to changed git output on push.
Change-Id: Ie4a5af81f66d5136dcf79d5988fa0e4fa6b277af
Signed-off-by: Edwin Kempin <ekempin@google.com>
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
JGit releases older than 4.5 are known to be prone to issues
with MissingObjectExceptions.
Change-Id: Ia9099a5ac8fcbaf873e3354b5a47d2178c97444a
Signed-off-by: Edwin Kempin <ekempin@google.com>
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
Includes several bug fixes including security fixes. See the release
notes [1] for full details.
[1] https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8
Change-Id: I1ae214c3b01644d6de2cc7b4d2f97f5de63d3b52
(cherry picked from commit 4f3a1fb18b9f83359e9f7f3f78917cc01f18ee39)
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | | |
Change-Id: I9069a720bdf6081d1793621e5fde8d6614c98c71
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | | |
Change-Id: Id062a5050589b43c02416ecb7ce32fb07f14a8fa
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
The LDAP groups are filtered by relevance to the Gerrit ACLs.
However, that optimization has the side effect of blocking users
to access legitimate projects if they are temporarily not cached
in memory.
Allow to disable the LDAP filtering optimization for having always
a 100% consistent ACL evaluation, regardless of the project's cache
status.
By default, keep the existing behaviour if not configured differently
on the gerrit.config.
Bug: Issue 9781
Change-Id: I4b66cbe40d7d260cc2d0ba4bdc1a5b22e99d5463
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
Gerrit cannot be built any more with upcoming Bazel 0.21 release.
That's because rules_closure depends on outdated protobuf version,
that uses some Bazel features that were discontinued in upcoming
Bazel 0.21 release.
Update rules_closure, to update protobuf to v3.6.1.3 so that we
can upgrade Bazel and build gerrit without passing incompatible
option:
--incompatible_package_name_is_a_function=false
Another reason to upgrade urgently is because Bazel team is
maintaining Gerrit job on the CI infrastructure and this job is
broken on Bazel master.
Bug: Issue 10112
Change-Id: Icf94c3ecaeff8fd1466620cd04673a781804d21b
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
For packages having a default visiblity defined, it is redundant to also
set the same visibility per package, so remove those.
For packages that only have one rule, and its visibility differs from the
default visibility, remove the default visibility.
Also clean up wrapping of some of the default definitions.
Change-Id: I9e81c3f724b4ffde7a652b485d33c650866ad122
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | | |
Change-Id: Ia199c7e3d8d716052e37fbf600f9f59ea4e7471a
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | | |
Change-Id: I6e8d9b78215d6fe3ce199b53fe850685d110b6e3
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | | |
Change-Id: Idd85e245b46969c87417714d0f0c30336e1d67bd
|
| |\ \ \ \ \ \
| | | | | | |
| | | | | | |
| | | | | | | |
into stable-2.14
|
| | | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | | |
Avoid loading versions from @bazel_skylib//:lib.bzl, because it is now
deprecated and is going to be removed in future skylib versions:
https://github.com/bazelbuild/bazel-skylib/blob/master/lib.bzl#L17
Change-Id: Idfd131cb1d773887bbc07faadd168da53524fdc0
|
| | | | | | | |
| | | | | | |
| | | | | | |
| | | | | | | |
Change-Id: I242972a06800798b6ad449109d765ac21f27d8b5
|
| |/ / / / / /
| | | | | |
| | | | | |
| | | | | | |
Change-Id: Iac9306a0cfd19e13226a58437536d0297642aca8
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
This line has seen some action before in I1867f633, and before that in
I265ef862. Rereading those commit messages, I see no reason why we
should be opening the repo and possibly triggering auto-rebuilding when
NoteDb writes and reads are both disabled.
This was causing NoSuchChangeExceptions in the case where the Change
contained a noteDbState field but the ref was absent. That logic is also
questionable, for reasons now mentioned in a TODO. But really we should
never be reaching the openHandle method when NoteDb is completely off.
Add a regression test that would have caught this.
Change-Id: If0970e1cf61e1d98ccbb3ce27549186f5771466a
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | | |
Change-Id: I40c1c54d024f646881c4e2534837c6f189e1debd
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
The only consumer of httpmime was Apache Solr, which was removed
in change Ic62ae3103 more than 3 years ago.
Change-Id: I6204dc74cc99a878ac4cac7c777a235544f9f80e
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
The elasticsearch-rest-client library has an explicit dependency on
version 4.4.5 of httpcore-nio [1], but the version provided by Gerrit
is tied to the same version 4.4.1 as all the other httpcomponents.
Since httpcore-nio is only used by elasticsearch-rest-client, we can
safely provide the required version. We can also restrict visibility
to the elasticsearch package to prevent accidental usage elsewhere.
The same is true for the httpasyncclient component, which we already
provide at the correct version as used by elasticsearch-rest-client,
so also restrict its visibility in the same way.
At the same time, move httpcore-nio and httpasyncclient declarations
up the WORKSPACE file adjacent to the other httpcomponents, and add
a comment to clarify that they are set at explicit versions for ES.
[1] https://search.maven.org/artifact/org.elasticsearch.client/elasticsearch-rest-client/6.4.2/jar
Bug: Issue 9969
Change-Id: Id80f92768667541604df0c53235ea81ecdda9c0e
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
This upgrade fixes the following CVEs:
- CVE-2017-7656 [1]:
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations),
and 9.4.x (non-default configuration with RFC2616 compliance enabled),
HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method
space URI space version) that declares a version of HTTP/0.9 was accepted
and treated as a 0.9 request. If deployed behind an intermediary that also
accepted and passed through the 0.9 version (but did not act on it), then
the response sent could be interpreted by the intermediary as HTTP/1
headers. This could be used to poison the cache if the server allowed the
origin client to generate arbitrary content in the response.
- CVE-2017-7657 [2]:
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and
9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-
encoding chunks are handled poorly. The chunk length parsing was vulnerable
to an integer overflow. Thus a large chunk size could be interpreted as a
smaller chunk size and content sent as chunk body could be interpreted as a
pipelined request. If Jetty was deployed behind an intermediary that imposed
some authorization and that intermediary allowed arbitrarily large chunks to
be passed on unchanged, then this flaw could be used to bypass the
authorization imposed by the intermediary as the fake pipelined request would
not be interpreted by the intermediary as a request.
- CVE-2017-7658 [3]:
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x
configurations), and 9.4.x (all HTTP/1.x configurations), when presented with
two content-length headers, Jetty ignored the second. When presented with a
content-length and a chunked encoding header, the content-length was ignored
(as per RFC 2616). If an intermediary decided on the shorter length, but still
passed on the longer body, then body content could be interpreted by Jetty as
a pipelined request. If the intermediary was imposing authorization, the fake
pipelined request would bypass that authorization.
- CVE-2017-9735 [4]:
Jetty through 9.4.x is prone to a timing channel in util/security/Password.java,
which makes it easier for remote attackers to obtain access by observing
elapsed times before rejection of incorrect passwords.
- CVE-2018-12536 [5]:
In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default
Error Handling, when an intentionally bad query arrives that doesn't match a
dynamic url-pattern, and is eventually handled by the DefaultServlet's static
file serving, the bad characters can trigger a
java.nio.file.InvalidPathException which includes the full path to the base
resource directory that the DefaultServlet and/or webapp is using. If this
InvalidPathException is then handled by the default Error Handler, the
InvalidPathException message is included in the error response, revealing the
full server path to the requesting system.
[1] https://nvd.nist.gov/vuln/detail/CVE-2017-7656
[2] https://nvd.nist.gov/vuln/detail/CVE-2017-7657
[3] https://nvd.nist.gov/vuln/detail/CVE-2017-7658
[4] https://nvd.nist.gov/vuln/detail/CVE-2017-9735
[5] https://nvd.nist.gov/vuln/detail/CVE-2018-12536
Bug: Issue 9952
Change-Id: I1ebb91406b88289e3803ffb1d5049ea7352c695c
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
This upgrade fixes CVE-2018-1000180 [1]:
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier
have a flaw in the Low-level interface to RSA key pair generator,
specifically RSA Key Pairs generated in low-level API with added
certainty may have less M-R tests than expected. This appears to be
fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.
and CVE-2018-1000613 [2]:
Bouncy Castle Java Cryptography APIs version prior to version 1.60
contains a CWE-470: Use of Externally-Controlled Input to Select
Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT
private key deserialization that can result in Deserializing an
XMSS/XMSS^MT private key can result in the execution of unexpected
code. This attack appear to be exploitable via a handcrafted private
key can include references to unexpected classes which will be picked
up from the class path for the executing application. This
vulnerability appears to have been fixed in 1.60 and later.
Bouncycastle 1.57 introduced generics in its APIs. Remove the casts
and @SuppressWarnings("unchecked") annotations that are not necessary
any more.
[1] https://nvd.nist.gov/vuln/detail/CVE-2018-1000180
[2] https://nvd.nist.gov/vuln/detail/CVE-2018-1000613
Bug: Issue 9952
Change-Id: I9b25b1568ac7da555de96d82c597b3dff47966c6
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
removePublicKey() operates by removing the chosen key and creating a
new PGPPublicKeyRing with the remainder. However, in BC 1.60[1], there
is new validation logic that requires the key in slot 0 to be a master
key.
In the test case, the master key is removed and reinserted, which
throws with the new validation. Fix it by removing the subkey before
attempting to remove the master key, and then adding it back.
[1] https://github.com/bcgit/bc-java/commit/1c3e644933b9e3b394bc7d89ff93badee448652c
Change-Id: Iee072294488bfaaa9ff60b5a1a199a01f4c9800d
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
This upgrade fixes CVE-2018-10237 [1]:
Unbounded memory allocation in Google Guava 11.0 through 24.x before
24.1.1 allows remote attackers to conduct denial of service attacks
against servers that depend on this library and deserialize attacker-
provided data, because the AtomicDoubleArray class (when serialized
with Java serialization) and the CompoundOrdering class (when
serialized with GWT serialization) perform eager allocation without
appropriate checks on what a client has sent and whether the data size
is reasonable.
[1] https://nvd.nist.gov/vuln/detail/CVE-2018-10237
This also adds dependency on j2objc-annotations to prevent the following
warning during the build:
INFO: From Building java/com/google/gerrit/lucene/liblucene.jar (12 source files):
warning: unknown enum constant ReflectionSupport$Level.FULL
reason: class file for com.google.j2objc.annotations.ReflectionSupport$Level not found
Bug: Issue 9952
Change-Id: Iea79ee7d93c4b7c85479b5ec01ee07e19beed611
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
CharMatcher.javaLetterOrDigit is deprecated in Guava 23.2 [1].
Replace it with regular expression for matching.
[1] https://github.com/google/guava/releases/tag/v23.2
Change-Id: Icaf7504e7250beaa92b9c86ad592649bd6fafcba
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
At Google we have tooling that points out unused futures and demands
explicit 'unused' statements to indicate that the return value is
ignored by intention.
In addition to that, this commit adds a comment about why it is safe to
ignore this future.
Change-Id: I7651011eef43c02fbf51e86720661ee4928e70af
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
This upgrade fixes CVE-2017-12629 [1]. Although this issue only affects
Solr, according to the description, it's probably worth upgrading anyway
since there have been several bug fixes in the intermediate versions.
See the release notes for 5.5.2 [2], 5.5.4 [3] and 5.5.5 [4] for details.
Note: there are no bug fixes listed for 5.5.3.
The only reason we didn't upgrade to the latest version before is because
we had a dependency on Elasticsearch which had a tight coupling with a
specific Lucene version.
[1] https://nvd.nist.gov/vuln/detail/CVE-2017-12629
[2] https://lucene.apache.org/core/5_5_2/changes/Changes.html#v5.5.2.bug_fixes
[3] https://lucene.apache.org/core/5_5_4/changes/Changes.html#v5.5.4.bug_fixes
[4] https://lucene.apache.org/core/5_5_5/changes/Changes.html#v5.5.5.bug_fixes
Bug: Issue 9952
Change-Id: I776e2dc10c86dc6761a0a1ce6644ce5ac384509c
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
This upgrade fixes CVE-2018-10936 [1]:
A weakness was found in postgresql-jdbc before version 42.2.5. It was
possible to provide an SSL Factory and not check the host name if a
host name verifier was not provided to the driver. This could lead to
a condition where a man-in-the-middle attacker could masquerade as a
trusted server by providing a certificate for the wrong host, as long
as it was signed by a trusted CA.
[1] https://nvd.nist.gov/vuln/detail/CVE-2018-10936
Bug: Issue 9952
Change-Id: I32972ae466a7876c221e6b678ffddcf3ca5a5a10
|
