Removing class objects comparison using getName(),getSimpleName() #24000
+15
−8
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
yingsu00
reviewed
Nov 13, 2024
| @@ -78,6 +78,7 @@ | |||
| public class TableWriterOperator | |||
| implements Operator | |||
| { | |||
| public static final String OPERATOR_TYPE_NAME = "TableWriterOperator"; | |||
There was a problem hiding this comment.
Why this one is OPERATOR_TYPE_NAME and other operators are OPERATOR_TYPE? Please unify the names.
There was a problem hiding this comment.
@yingsu00 made the required changes. Can you please verify
Changes to correct Operator Type
bibith4
force-pushed
the
static_cve_fix_class_obj_compare_removal
branch
from
8a80c77
to
6741f55
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Changes to remove class objects comparison using the methods getName(),getSimpleName() to improve security.
Made changes in
presto-hive/src/main/java/com/facebook/presto/hive/HiveUtil.java
presto-main/src/main/java/com/facebook/presto/execution/QueryStats.java
presto-main/src/main/java/com/facebook/presto/execution/executor/TaskExecutor.java
presto-main/src/main/java/com/facebook/presto/operator/AggregationOperator.java
presto-main/src/main/java/com/facebook/presto/operator/HashAggregationOperator.java
presto-main/src/main/java/com/facebook/presto/operator/HashBuilderOperator.java
presto-main/src/main/java/com/facebook/presto/operator/TableWriterOperator.java
presto-main/src/main/java/com/facebook/presto/operator/TaskContext.java
presto-main/src/main/java/com/facebook/presto/operator/scalar/JoniRegexpFunctions.java
Motivation and Context
Do not compare class objects using the getName() or getSimpleName() method which may causes multiple security vulnerabilities includes String manipulations,class spoofing and namespace collisions
Impact
No impact
Test Plan
Verified existing Unit test case for above fix
presto-hive/src/test/java/com/facebook/presto/hive/TestHiveUtil.java
presto-main/src/test/java/com/facebook/presto/execution/TestQueryStats.java
presto-main/src/test/java/com/facebook/presto/execution/executor/TestTaskExecutor.java
presto-main/src/main/java/com/facebook/presto/testing/TestingTaskContext.java
Release Notes