FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Updates for CVE-2023-51074 and CVE-2023-5072 by joseph-neeraj · Pull Request #92 · Mastercard/client-encryption-java · GitHub

/ client-encryption-java Public

Updates for CVE-2023-51074 and CVE-2023-5072 - #92

Merged
joseph-neeraj merged 2 commits into
mainfrom
fix/CVE-2023-51074andCVE-2023-5072
Apr 15, 2024
ConversationCommits (2)ChecksFiles changed
Merged

Updates for CVE-2023-51074 and CVE-2023-5072#92
joseph-neeraj merged 2 commits into
mainfrom
fix/CVE-2023-51074andCVE-2023-5072

Conversation

joseph-neeraj commented Apr 12, 2024

Copy link
Copy Markdown
Contributor

PR checklist

  • An issue/feature request has been created for this PR
  • Pull Request title clearly describes the work in the pull request and the Pull Request description provides details about how to validate the work. Missing information here may result in a delayed response.
  • File the PR against the main branch
  • The code in this PR is covered by unit tests

Link to issue/feature request: #90

Description

Updates the org.json.json and com.jayway.jsonpath.json-path libraries which fix CVE-2023-51074 and CVE-2023-5072.

Had to make code changes because the json-path library introduced a bug in the updated version which fails a few unit tests in our repo. See this PR to track the issue json-path/JsonPath#871

Updates for CVE-2023-51074 and CVE-2023-5072
8993045 
Updates the org.json.json and com.jayway.jsonpath.json-path libraries which fix CVE-2023-51074 and CVE-2023-5072.

Had to make code changes because the json-path library introduced a bug in the updated version which fails a few unit tests in our repo.
See this PR to track the issue json-path/JsonPath#871
karen-avetisyan-mc suggested changes Apr 12, 2024
View reviewed changes
Comment thread src/main/java/com/mastercard/developer/encryption/JsonParser.java Outdated
return jsonElement;
}

// Upgrading the json-path lib from 2.6.0 to 2.9.0 introduced a bug where when you

karen-avetisyan-mc Apr 12, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

please remove this comment

karen-avetisyan-mc Apr 12, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Sorry, I meant : remove all of this: // try to delete a non-existent key in a DocumentContext with the SUPPRESS_EXCEPTIONS flag,
// it would throw a ClassCastException. This method is a workaround for the issue.
// Once this issue is fixed this method's usages can be replaced with a simple DocumentContext.delete(path).
// Track the issue here json-path/JsonPath#870

danny-gallagher Apr 15, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

We could leave this comment in until this issue is fixed. It's a good way to make sure we revisit it in the future.

karen-avetisyan-mc Apr 15, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Sorry, folks, I would insist that we remove this comment. There will be no reason to update this library, unless another security issue. let keep it code clean.

joseph-neeraj Apr 15, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

removed it now.

karen-avetisyan-mc self-requested a review April 12, 2024 15:25
karen-avetisyan-mc suggested changes Apr 12, 2024
View reviewed changes
Comment thread src/main/java/com/mastercard/developer/encryption/JsonParser.java Outdated
return jsonElement;
}

// Upgrading the json-path lib from 2.6.0 to 2.9.0 introduced a bug where when you

karen-avetisyan-mc Apr 12, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Sorry, I meant : remove all of this: // try to delete a non-existent key in a DocumentContext with the SUPPRESS_EXCEPTIONS flag,
// it would throw a ClassCastException. This method is a workaround for the issue.
// Once this issue is fixed this method's usages can be replaced with a simple DocumentContext.delete(path).
// Track the issue here json-path/JsonPath#870

karen-avetisyan-mc self-requested a review April 12, 2024 15:41
danny-gallagher approved these changes Apr 15, 2024
View reviewed changes

danny-gallagher left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

LGTM!

karen-avetisyan-mc suggested changes Apr 15, 2024
View reviewed changes
Comment thread src/main/java/com/mastercard/developer/encryption/JsonParser.java Outdated
return jsonElement;
}

// Upgrading the json-path lib from 2.6.0 to 2.9.0 introduced a bug where when you

karen-avetisyan-mc Apr 15, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Sorry, folks, I would insist that we remove this comment. There will be no reason to update this library, unless another security issue. let keep it code clean.

joseph-neeraj force-pushed the fix/CVE-2023-51074andCVE-2023-5072 branch from 9f57f5e to 265773d Compare April 15, 2024 13:08
karen-avetisyan-mc approved these changes Apr 15, 2024
View reviewed changes

karen-avetisyan-mc left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

LGTM

joseph-neeraj merged commit d347e61 into main Apr 15, 2024
joseph-neeraj deleted the fix/CVE-2023-51074andCVE-2023-5072 branch April 15, 2024 13:11
This was referenced Apr 15, 2024
Closed
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

danny-gallagher danny-gallagher approved these changes
+1 more reviewer
karen-avetisyan-mc karen-avetisyan-mc approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

Back | FazBrowse Home | New Git URL