phoenix-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Hadoop QA (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (PHOENIX-4188) Disable DTD parsing on Pherf XML documents
Date Mon, 11 Sep 2017 15:41:00 GMT

    [ https://issues.apache.org/jira/browse/PHOENIX-4188?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16161457#comment-16161457
] 

Hadoop QA commented on PHOENIX-4188:
------------------------------------

{color:red}-1 overall{color}.  Here are the results of testing the latest attachment 
  http://issues.apache.org/jira/secure/attachment/12886443/PHOENIX-4188.002.patch
  against master branch at commit 7865a59b0bbc4ea5e8ab775b920f5f608115707b.
  ATTACHMENT ID: 12886443

    {color:green}+1 @author{color}.  The patch does not contain any @author tags.

    {color:green}+1 tests included{color}.  The patch appears to include 16 new or modified
tests.

    {color:green}+1 javac{color}.  The applied patch does not increase the total number of
javac compiler warnings.

    {color:green}+1 release audit{color}.  The applied patch does not increase the total number
of release audit warnings.

    {color:red}-1 lineLengths{color}.  The patch introduces the following lines longer than
100:
    +        URL scenarioUrl = XMLConfigParserTest.class.getResource("/scenario/malicious_scenario_with_dtd.xml");
+<ns3:dataModelResult xmlns:ns2="org.apache.phoenix.pherf.configuration.DataModel" xmlns:ns3="org.apache.phoenix.pherf.result"
zookeeper="localhost:2181/hbase" name="test_scenario">
+        <querySetResult concurrency="1-3" executionDurationInMs="5000" executionType="SERIAL"
numberOfExecutions="100">
+            <queryResults expectedAggregateRowCount="50" id="q1" statement="select count(*)
from PHERF.USER_DEFINED_TEST">
+                    <runTimesInMs elapsedDurationInMs="37" resultRowCount="50" startTime="2017-09-08T19:27:41.556-04:00"/>
+                    <runTimesInMs elapsedDurationInMs="20" resultRowCount="50" startTime="2017-09-08T19:27:41.671-04:00"/>
+                    <runTimesInMs elapsedDurationInMs="18" resultRowCount="50" startTime="2017-09-08T19:27:41.691-04:00"/>
+                    <runTimesInMs elapsedDurationInMs="22" resultRowCount="50" startTime="2017-09-08T19:27:41.709-04:00"/>
+                    <runTimesInMs elapsedDurationInMs="20" resultRowCount="50" startTime="2017-09-08T19:27:41.731-04:00"/>
+                    <runTimesInMs elapsedDurationInMs="16" resultRowCount="50" startTime="2017-09-08T19:27:41.751-04:00"/>

     {color:red}-1 core tests{color}.  The patch failed these unit tests:
     

Test results: https://builds.apache.org/job/PreCommit-PHOENIX-Build/1418//testReport/
Console output: https://builds.apache.org/job/PreCommit-PHOENIX-Build/1418//console

This message is automatically generated.

> Disable DTD parsing on Pherf XML documents
> ------------------------------------------
>
>                 Key: PHOENIX-4188
>                 URL: https://issues.apache.org/jira/browse/PHOENIX-4188
>             Project: Phoenix
>          Issue Type: Bug
>            Reporter: Josh Elser
>            Assignee: Josh Elser
>             Fix For: 4.12.0
>
>         Attachments: PHOENIX-4188.001.patch, PHOENIX-4188.002.patch
>
>
> A security scan dinged Phoenix for an external entities attack on the XML files that
Pherf creates.
> We can easily work around it by disabling the inline doctype definition in the XML parser
we use.



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)

Mime
View raw message