[SPARK-11652] [CORE] Remote code execution with InvokerTransformer

[srowen]

Update to Commons Collections 3.2.2 to avoid any potential remote code execution vulnerability

[SparkQA]

Test build #45991 has finished for PR 9731 at commit 0828753.

• This patch fails Spark unit tests.
• This patch merges cleanly.
• This patch adds the following public classes (experimental):\n * case class JSONOptions(\n

[SparkQA]

Test build #2064 has finished for PR 9731 at commit 0828753.

• This patch passes all tests.
• This patch merges cleanly.
• This patch adds no public classes.

[srowen]

I'm going to go ahead and merge this, as it's a bug fix update anyway, passes, and should make sure there's no exploit of this form. We may not be alone in getting some alarmed customer questions about this, even though I suspect there is no actual exploit in Spark.

[srowen]

Merged to master/1.6/1.5/1.4

[XuTingjun]

@srowen I can't find this jar file, can you give me a download url?

[XuTingjun]

@srowen I only find below commons-collection file:

<groupId>commons-collections</groupId>
  <artifactId>commons-collections</artifactId>
  <version>3.2.2</version>

[srowen]

@XuTingjun commons-collections? just search Maven Central
http://search.maven.org/#search%7Cgav%7C1%7Cg%3A%22commons-collections%22%20AND%20a%3A%22commons-collections%22

[XuTingjun]

I think the groupId should be "commons-collections", not "org.apache.commons", right?

[srowen]

Oh dang it, yes the group is only org.apache.commons in version 4. Right now this does nothing. PR coming ...

[XuTingjun]

ok, please fix it as soon as possible, thanks.

[srowen]

See #10198