Skip to content

Commit

Permalink
[SPARK-28713][BUILD][2.4] Bump checkstyle from 8.2 to 8.23
Browse files Browse the repository at this point in the history
## What changes were proposed in this pull request?

Backport to `branch-2.4` of #25432

Fixes a vulnerability from the GitHub Security Advisory Database:

_Moderate severity vulnerability that affects com.puppycrawl.tools:checkstyle_
Checkstyle prior to 8.18 loads external DTDs by default, which can potentially lead to denial of service attacks or the leaking of confidential information.

checkstyle/checkstyle#6474

Affected versions: < 8.18

## How was this patch tested?

Ran checkstyle locally.

Closes #25437 from Fokko/branch-2.4.

Authored-by: Fokko Driesprong <fokko@apache.org>
Signed-off-by: Dongjoon Hyun <dhyun@apple.com>
  • Loading branch information
Fokko authored and dongjoon-hyun committed Aug 13, 2019
1 parent c37abba commit dfcebca
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 5 deletions.
13 changes: 9 additions & 4 deletions pom.xml
Expand Up @@ -2550,12 +2550,17 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-checkstyle-plugin</artifactId>
<version>2.17</version>
<version>3.0.0</version>
<configuration>
<failOnViolation>false</failOnViolation>
<includeTestSourceDirectory>true</includeTestSourceDirectory>
<sourceDirectories>${basedir}/src/main/java,${basedir}/src/main/scala</sourceDirectories>
<testSourceDirectory>${basedir}/src/test/java</testSourceDirectory>
<sourceDirectories>
<directory>${basedir}/src/main/java</directory>
<directory>${basedir}/src/main/scala</directory>
</sourceDirectories>
<testSourceDirectories>
<directory>${basedir}/src/test/java</directory>
</testSourceDirectories>
<configLocation>dev/checkstyle.xml</configLocation>
<outputFile>${basedir}/target/checkstyle-output.xml</outputFile>
<inputEncoding>${project.build.sourceEncoding}</inputEncoding>
Expand All @@ -2565,7 +2570,7 @@
<dependency>
<groupId>com.puppycrawl.tools</groupId>
<artifactId>checkstyle</artifactId>
<version>8.2</version>
<version>8.23</version>
</dependency>
</dependencies>
<executions>
Expand Down
2 changes: 1 addition & 1 deletion project/plugins.sbt
@@ -1,7 +1,7 @@
addSbtPlugin("com.etsy" % "sbt-checkstyle-plugin" % "3.1.1")

// sbt-checkstyle-plugin uses an old version of checkstyle. Match it to Maven's.
libraryDependencies += "com.puppycrawl.tools" % "checkstyle" % "8.2"
libraryDependencies += "com.puppycrawl.tools" % "checkstyle" % "8.23"

// checkstyle uses guava 23.0.
libraryDependencies += "com.google.guava" % "guava" % "23.0"
Expand Down

0 comments on commit dfcebca

Please sign in to comment.