diff --git a/.travis.yml b/.travis.yml
index f4aa88b4bdc..a0ad65bdb1f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -114,6 +114,18 @@ jobs:
https://maven.apache.org/plugins/maven-dependency-plugin/analyze-mojo.html
"
+ - name: "security vulnerabilities"
+ install: skip
+ script: ${MVN} dependency-check:check
+ after_failure: |-
+ echo "FAILURE EXPLANATION:
+
+ The OWASP dependency check has found security vulnerabilities. Please use a newer version
+ of the dependency that does not have vulenerabilities. If the analysis has false positives,
+ they can be suppressed by adding entries to owasp-dependency-check-suppressions.xml (for more
+ information, see https://jeremylong.github.io/DependencyCheck/general/suppression.html).
+ "
+
- &package
name: "(openjdk8) packaging check"
install: skip
diff --git a/benchmarks/pom.xml b/benchmarks/pom.xml
index 027f81f6737..9b85b21cf10 100644
--- a/benchmarks/pom.xml
+++ b/benchmarks/pom.xml
@@ -216,6 +216,13 @@
+
+ org.owasp
+ dependency-check-maven
+
+ true
+
+
diff --git a/core/src/main/java/org/apache/druid/data/input/impl/prefetch/JsonIterator.java b/core/src/main/java/org/apache/druid/data/input/impl/prefetch/JsonIterator.java
index 6bd56cbc2a6..2a241f66de7 100644
--- a/core/src/main/java/org/apache/druid/data/input/impl/prefetch/JsonIterator.java
+++ b/core/src/main/java/org/apache/druid/data/input/impl/prefetch/JsonIterator.java
@@ -43,7 +43,7 @@ public class JsonIterator implements Iterator, Closeable
{
private JsonParser jp;
private ObjectCodec objectCodec;
- private final TypeReference typeRef;
+ private final TypeReference typeRef;
private final InputStream inputStream;
private final Closeable resourceCloser;
private final ObjectMapper objectMapper;
@@ -55,7 +55,7 @@ public class JsonIterator implements Iterator, Closeable
* @param objectMapper object mapper, used for deserialization
*/
public JsonIterator(
- TypeReference typeRef,
+ TypeReference typeRef,
InputStream inputStream,
Closeable resourceCloser,
ObjectMapper objectMapper
diff --git a/distribution/bin/check-licenses.py b/distribution/bin/check-licenses.py
index cbbcf3c1831..aad34cb5ca3 100755
--- a/distribution/bin/check-licenses.py
+++ b/distribution/bin/check-licenses.py
@@ -239,6 +239,7 @@ def build_compatible_license_names():
compatible_licenses['The BSD 3-Clause License'] = 'BSD-3-Clause License'
compatible_licenses['Revised BSD'] = 'BSD-3-Clause License'
compatible_licenses['New BSD License'] = 'BSD-3-Clause License'
+ compatible_licenses['3-Clause BSD License'] = 'BSD-3-Clause License'
compatible_licenses['ICU License'] = 'ICU License'
@@ -254,6 +255,10 @@ def build_compatible_license_names():
compatible_licenses['Eclipse Public License - Version 1.0'] = 'Eclipse Public License 1.0'
compatible_licenses['Eclipse Public License, Version 1.0'] = 'Eclipse Public License 1.0'
+ compatible_licenses['Eclipse Distribution License 1.0'] = 'Eclipse Distribution License 1.0'
+ compatible_licenses['Eclipse Distribution License - v 1.0'] = 'Eclipse Distribution License 1.0'
+ compatible_licenses['EDL 1.0'] = 'Eclipse Distribution License 1.0'
+
compatible_licenses['Mozilla Public License Version 2.0'] = 'Mozilla Public License Version 2.0'
compatible_licenses['Mozilla Public License, Version 2.0'] = 'Mozilla Public License Version 2.0'
diff --git a/distribution/pom.xml b/distribution/pom.xml
index 215cd8d95b1..ac8848fa7e9 100644
--- a/distribution/pom.xml
+++ b/distribution/pom.xml
@@ -98,6 +98,13 @@
+
+ org.owasp
+ dependency-check-maven
+
+ true
+
+
@@ -421,4 +428,4 @@
-
\ No newline at end of file
+
diff --git a/extensions-contrib/ambari-metrics-emitter/pom.xml b/extensions-contrib/ambari-metrics-emitter/pom.xml
index fb81ee14695..59639ab20f9 100644
--- a/extensions-contrib/ambari-metrics-emitter/pom.xml
+++ b/extensions-contrib/ambari-metrics-emitter/pom.xml
@@ -69,6 +69,12 @@
+
+
+ org.apache.hadoop
+ hadoop-annotations
+ ${hadoop.compile.version}
+
commons-io
commons-io
@@ -126,6 +132,22 @@
test
+
+
+
+
+ org.apache.maven.plugins
+ maven-dependency-plugin
+
+
+
+ org.apache.hadoop:hadoop-annotations
+
+
+
+
+
+
hortonworks
diff --git a/extensions-contrib/cassandra-storage/pom.xml b/extensions-contrib/cassandra-storage/pom.xml
index 6171a008fc3..993e0057300 100644
--- a/extensions-contrib/cassandra-storage/pom.xml
+++ b/extensions-contrib/cassandra-storage/pom.xml
@@ -41,6 +41,11 @@
provided
+
com.netflix.astyanax
astyanax
1.0.1
@@ -113,6 +118,11 @@
com.github.stephenc.high-scale-lib
high-scale-lib
+
+
+ org.mortbay.jetty
+ jetty
+
diff --git a/extensions-contrib/moving-average-query/src/test/java/org/apache/druid/query/movingaverage/MovingAverageQueryTest.java b/extensions-contrib/moving-average-query/src/test/java/org/apache/druid/query/movingaverage/MovingAverageQueryTest.java
index ca9e4c5ec18..83881c79cf9 100644
--- a/extensions-contrib/moving-average-query/src/test/java/org/apache/druid/query/movingaverage/MovingAverageQueryTest.java
+++ b/extensions-contrib/moving-average-query/src/test/java/org/apache/druid/query/movingaverage/MovingAverageQueryTest.java
@@ -38,7 +38,6 @@ import org.apache.druid.client.cache.ForegroundCachePopulator;
import org.apache.druid.client.cache.MapCache;
import org.apache.druid.client.selector.ServerSelector;
import org.apache.druid.data.input.MapBasedRow;
-import org.apache.druid.data.input.Row;
import org.apache.druid.guice.DruidProcessingModule;
import org.apache.druid.guice.GuiceInjectors;
import org.apache.druid.guice.QueryRunnerFactoryModule;
@@ -99,7 +98,7 @@ public class MovingAverageQueryTest extends InitializedNullHandlingTest
private final RetryQueryRunnerConfig retryConfig;
private final ServerConfig serverConfig;
- private final List groupByResults = new ArrayList<>();
+ private final List groupByResults = new ArrayList<>();
private final List> timeseriesResults = new ArrayList<>();
private final TestConfig config;
@@ -222,9 +221,9 @@ public class MovingAverageQueryTest extends InitializedNullHandlingTest
return MovingAverageQuery.class;
}
- private TypeReference> getExpectedResultType()
+ private TypeReference> getExpectedResultType()
{
- return new TypeReference>()
+ return new TypeReference>()
{
};
}
diff --git a/extensions-contrib/thrift-extensions/pom.xml b/extensions-contrib/thrift-extensions/pom.xml
index 80c9af2145f..71d5b03ee5d 100644
--- a/extensions-contrib/thrift-extensions/pom.xml
+++ b/extensions-contrib/thrift-extensions/pom.xml
@@ -36,7 +36,7 @@
4.0.0
- 0.10.0
+ 0.13.0
4.17
19.10.0
diff --git a/extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/BasicAuthUtils.java b/extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/BasicAuthUtils.java
index 21664d0659f..1646fc334b1 100644
--- a/extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/BasicAuthUtils.java
+++ b/extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/BasicAuthUtils.java
@@ -67,32 +67,32 @@ public class BasicAuthUtils
public static final int KEY_LENGTH = 512;
public static final String ALGORITHM = "PBKDF2WithHmacSHA512";
- public static final TypeReference AUTHENTICATOR_USER_MAP_TYPE_REFERENCE =
+ public static final TypeReference