Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added jackson dependency to server #5366

Merged
merged 6 commits into from
Dec 9, 2022
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
- [Test] Add IAE test for deprecated edgeNGram analyzer name ([#5040](https://github.com/opensearch-project/OpenSearch/pull/5040))
- Allow mmap to use new JDK-19 preview APIs in Apache Lucene 9.4+ ([#5151](https://github.com/opensearch-project/OpenSearch/pull/5151))
- Add feature flag for extensions ([#5211](https://github.com/opensearch-project/OpenSearch/pull/5211))
- Added jackson dependency to server ([#5366] (https://github.com/opensearch-project/OpenSearch/pull/5366))

### Dependencies
- Bumps `log4j-core` from 2.18.0 to 2.19.0
Expand Down
2 changes: 0 additions & 2 deletions modules/ingest-geoip/build.gradle
Original file line number Diff line number Diff line change
Expand Up @@ -41,8 +41,6 @@ opensearchplugin {
dependencies {
api('com.maxmind.geoip2:geoip2:3.0.2')
// geoip2 dependencies:
api("com.fasterxml.jackson.core:jackson-annotations:${versions.jackson}")
api("com.fasterxml.jackson.core:jackson-databind:${versions.jackson_databind}")
api('com.maxmind.db:maxmind-db:2.1.0')

testImplementation 'org.elasticsearch:geolite2-databases:20191119'
Expand Down

This file was deleted.

8 changes: 0 additions & 8 deletions modules/ingest-geoip/licenses/jackson-annotations-LICENSE

This file was deleted.

20 changes: 0 additions & 20 deletions modules/ingest-geoip/licenses/jackson-annotations-NOTICE

This file was deleted.

This file was deleted.

8 changes: 0 additions & 8 deletions modules/ingest-geoip/licenses/jackson-databind-LICENSE

This file was deleted.

20 changes: 0 additions & 20 deletions modules/ingest-geoip/licenses/jackson-databind-NOTICE

This file was deleted.

2 changes: 0 additions & 2 deletions plugins/discovery-ec2/build.gradle
Original file line number Diff line number Diff line change
Expand Up @@ -46,8 +46,6 @@ dependencies {
api "commons-logging:commons-logging:${versions.commonslogging}"
api "org.apache.logging.log4j:log4j-1.2-api:${versions.log4j}"
api "commons-codec:commons-codec:${versions.commonscodec}"
api "com.fasterxml.jackson.core:jackson-databind:${versions.jackson_databind}"
api "com.fasterxml.jackson.core:jackson-annotations:${versions.jackson}"
}

restResources {
Expand Down
8 changes: 0 additions & 8 deletions plugins/discovery-ec2/licenses/jackson-LICENSE

This file was deleted.

20 changes: 0 additions & 20 deletions plugins/discovery-ec2/licenses/jackson-NOTICE

This file was deleted.

This file was deleted.

This file was deleted.

2 changes: 0 additions & 2 deletions plugins/repository-azure/build.gradle
Original file line number Diff line number Diff line change
Expand Up @@ -61,8 +61,6 @@ dependencies {
api 'io.projectreactor.netty:reactor-netty-core:1.0.24'
api 'io.projectreactor.netty:reactor-netty-http:1.0.24'
api "org.slf4j:slf4j-api:${versions.slf4j}"
api "com.fasterxml.jackson.core:jackson-annotations:${versions.jackson}"
api "com.fasterxml.jackson.core:jackson-databind:${versions.jackson_databind}"
api "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:${versions.jackson}"
api "com.fasterxml.jackson.dataformat:jackson-dataformat-xml:${versions.jackson}"
api "com.fasterxml.jackson.module:jackson-module-jaxb-annotations:${versions.jackson}"
Expand Down

This file was deleted.

This file was deleted.

This file was deleted.

3 changes: 0 additions & 3 deletions plugins/repository-s3/build.gradle
Original file line number Diff line number Diff line change
Expand Up @@ -54,9 +54,6 @@ dependencies {
api "commons-logging:commons-logging:${versions.commonslogging}"
api "org.apache.logging.log4j:log4j-1.2-api:${versions.log4j}"
api "commons-codec:commons-codec:${versions.commonscodec}"
api "com.fasterxml.jackson.core:jackson-core:${versions.jackson}"
api "com.fasterxml.jackson.core:jackson-databind:${versions.jackson_databind}"
api "com.fasterxml.jackson.core:jackson-annotations:${versions.jackson}"
api "com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:${versions.jackson}"
api "joda-time:joda-time:${versions.joda}"

Expand Down
8 changes: 0 additions & 8 deletions plugins/repository-s3/licenses/jackson-LICENSE

This file was deleted.

20 changes: 0 additions & 20 deletions plugins/repository-s3/licenses/jackson-NOTICE

This file was deleted.

This file was deleted.

This file was deleted.

26 changes: 4 additions & 22 deletions server/build.gradle
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,10 @@ dependencies {
// jna
api "net.java.dev.jna:jna:${versions.jna}"

// jackson
api "com.fasterxml.jackson.core:jackson-databind:${versions.jackson_databind}"
api "com.fasterxml.jackson.core:jackson-annotations:${versions.jackson}"

testImplementation(project(":test:framework")) {
// tests use the locally compiled version of server
exclude group: 'org.opensearch', module: 'server'
Expand Down Expand Up @@ -208,31 +212,12 @@ tasks.named("processResources").configure {

tasks.named("thirdPartyAudit").configure {
ignoreMissingClasses(
// from com.fasterxml.jackson.dataformat.yaml.YAMLMapper (jackson-dataformat-yaml)
'com.fasterxml.jackson.databind.ObjectMapper',

// from log4j
'com.conversantmedia.util.concurrent.SpinPolicy',
'com.fasterxml.jackson.annotation.JsonInclude$Include',
'com.fasterxml.jackson.databind.DeserializationContext',
'com.fasterxml.jackson.databind.DeserializationFeature',
'com.fasterxml.jackson.databind.JsonMappingException',
'com.fasterxml.jackson.databind.JsonNode',
'com.fasterxml.jackson.databind.Module$SetupContext',
'com.fasterxml.jackson.databind.ObjectReader',
'com.fasterxml.jackson.databind.ObjectWriter',
'com.fasterxml.jackson.databind.SerializerProvider',
'com.fasterxml.jackson.databind.deser.std.StdDeserializer',
'com.fasterxml.jackson.databind.deser.std.StdScalarDeserializer',
'com.fasterxml.jackson.databind.module.SimpleModule',
'com.fasterxml.jackson.databind.ser.impl.SimpleBeanPropertyFilter',
'com.fasterxml.jackson.databind.ser.impl.SimpleFilterProvider',
'com.fasterxml.jackson.databind.ser.std.StdScalarSerializer',
'com.fasterxml.jackson.databind.ser.std.StdSerializer',
'com.fasterxml.jackson.dataformat.xml.JacksonXmlModule',
'com.fasterxml.jackson.dataformat.xml.XmlMapper',
'com.fasterxml.jackson.dataformat.xml.util.DefaultXmlPrettyPrinter',
'com.fasterxml.jackson.databind.node.ObjectNode',
'org.fusesource.jansi.Ansi',
'org.fusesource.jansi.AnsiRenderer$Code',
'com.lmax.disruptor.EventFactory',
Expand Down Expand Up @@ -292,9 +277,6 @@ tasks.named("thirdPartyAudit").configure {
'org.noggit.JSONParser',

// from lucene-spatial
'com.fasterxml.jackson.databind.JsonSerializer',
'com.fasterxml.jackson.databind.JsonDeserializer',
'com.fasterxml.jackson.databind.node.ArrayNode',
'com.google.common.geometry.S2Cell',
'com.google.common.geometry.S2CellId',
'com.google.common.geometry.S2Projections',
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,9 @@ grant {
permission jdk.net.NetworkPermission "getOption.TCP_KEEPCOUNT";
permission jdk.net.NetworkPermission "setOption.TCP_KEEPCOUNT";

permission java.lang.RuntimePermission "accessDeclaredMembers";
permission java.lang.reflect.ReflectPermission "suppressAccessChecks";

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dblock @saratvemulapalli @dbwiddis since we are removing jackson library from the native plugins and adding it in server. Need to add the above permissions. Looking for some advice if providing accessDeclaredMembers will bring any security concerns since we are enabling it for the server module? If not, then I guess we are good to go.

Copy link
Member Author

@ryanbogan ryanbogan Dec 7, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

^ We have these lines in feature/extensions as well so if there are security concerns we should fix them there too.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's open an issue. I don't know what the impact of this change is.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ryanbogan can you take care of it?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Already open: #5504

// Allow read access to all system properties
permission java.util.PropertyPermission "*", "read";

Expand Down