phoenix-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Hadoop QA (JIRA)" <>
Subject [jira] [Commented] (PHOENIX-4188) Disable DTD parsing on Pherf XML documents
Date Mon, 11 Sep 2017 15:41:00 GMT


Hadoop QA commented on PHOENIX-4188:

{color:red}-1 overall{color}.  Here are the results of testing the latest attachment
  against master branch at commit 7865a59b0bbc4ea5e8ab775b920f5f608115707b.
  ATTACHMENT ID: 12886443

    {color:green}+1 @author{color}.  The patch does not contain any @author tags.

    {color:green}+1 tests included{color}.  The patch appears to include 16 new or modified

    {color:green}+1 javac{color}.  The applied patch does not increase the total number of
javac compiler warnings.

    {color:green}+1 release audit{color}.  The applied patch does not increase the total number
of release audit warnings.

    {color:red}-1 lineLengths{color}.  The patch introduces the following lines longer than
    +        URL scenarioUrl = XMLConfigParserTest.class.getResource("/scenario/malicious_scenario_with_dtd.xml");
+<ns3:dataModelResult xmlns:ns2="org.apache.phoenix.pherf.configuration.DataModel" xmlns:ns3="org.apache.phoenix.pherf.result"
zookeeper="localhost:2181/hbase" name="test_scenario">
+        <querySetResult concurrency="1-3" executionDurationInMs="5000" executionType="SERIAL"
+            <queryResults expectedAggregateRowCount="50" id="q1" statement="select count(*)
+                    <runTimesInMs elapsedDurationInMs="37" resultRowCount="50" startTime="2017-09-08T19:27:41.556-04:00"/>
+                    <runTimesInMs elapsedDurationInMs="20" resultRowCount="50" startTime="2017-09-08T19:27:41.671-04:00"/>
+                    <runTimesInMs elapsedDurationInMs="18" resultRowCount="50" startTime="2017-09-08T19:27:41.691-04:00"/>
+                    <runTimesInMs elapsedDurationInMs="22" resultRowCount="50" startTime="2017-09-08T19:27:41.709-04:00"/>
+                    <runTimesInMs elapsedDurationInMs="20" resultRowCount="50" startTime="2017-09-08T19:27:41.731-04:00"/>
+                    <runTimesInMs elapsedDurationInMs="16" resultRowCount="50" startTime="2017-09-08T19:27:41.751-04:00"/>

     {color:red}-1 core tests{color}.  The patch failed these unit tests:

Test results:
Console output:

This message is automatically generated.

> Disable DTD parsing on Pherf XML documents
> ------------------------------------------
>                 Key: PHOENIX-4188
>                 URL:
>             Project: Phoenix
>          Issue Type: Bug
>            Reporter: Josh Elser
>            Assignee: Josh Elser
>             Fix For: 4.12.0
>         Attachments: PHOENIX-4188.001.patch, PHOENIX-4188.002.patch
> A security scan dinged Phoenix for an external entities attack on the XML files that
Pherf creates.
> We can easily work around it by disabling the inline doctype definition in the XML parser
we use.

This message was sent by Atlassian JIRA

View raw message