Skip to content

Commit 016edf3

Browse files
JvD-EricssonJvD-Ericsson
committed
Upgrade Jetty to 12.0.12
1. Why: To remove CVEs: - CVE-2024-6763 - CVE-2024-13009 2. What: Upgrade jetty to 12.0.12 to remove CVE-2024-13009 and CVE-2024-6763, - [x] security/CVE Signed-off-by: JvD_Ericsson <jeff.van.dam@est.tech>
1 parent 71b963b commit 016edf3

55 files changed

Lines changed: 995 additions & 740 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,7 @@ project(':cruise-control-core') {
188188
implementation "org.slf4j:slf4j-api:1.7.36"
189189
implementation "org.apache.logging.log4j:log4j-slf4j-impl:2.17.2"
190190
implementation 'org.apache.commons:commons-math3:3.6.1'
191-
api "org.eclipse.jetty:jetty-servlet:${jettyVersion}"
191+
api "org.eclipse.jetty.ee10:jetty-ee10-servlet:${jettyVersion}"
192192
implementation 'com.github.spotbugs:spotbugs-annotations:4.8.6'
193193

194194
api "io.vertx:vertx-core:${vertxVersion}"

‎cruise-control/src/main/java/com/linkedin/kafka/cruisecontrol/KafkaCruiseControlServletApp.java‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
import com.linkedin.kafka.cruisecontrol.servlet.ServletRequestHandler;
99
import com.linkedin.kafka.cruisecontrol.servlet.security.CruiseControlSecurityHandler;
1010
import com.linkedin.kafka.cruisecontrol.servlet.security.SecurityProvider;
11-
import org.eclipse.jetty.security.ConstraintSecurityHandler;
11+
import org.eclipse.jetty.ee10.servlet.security.ConstraintSecurityHandler;
1212
import org.eclipse.jetty.server.Connector;
1313
import org.eclipse.jetty.server.CustomRequestLog;
1414
import org.eclipse.jetty.server.HttpConfiguration;
@@ -17,11 +17,11 @@
1717
import org.eclipse.jetty.server.Server;
1818
import org.eclipse.jetty.server.ServerConnector;
1919
import org.eclipse.jetty.server.Slf4jRequestLogWriter;
20-
import org.eclipse.jetty.servlet.DefaultServlet;
21-
import org.eclipse.jetty.servlet.ServletContextHandler;
22-
import org.eclipse.jetty.servlet.ServletHolder;
20+
import org.eclipse.jetty.ee10.servlet.DefaultServlet;
21+
import org.eclipse.jetty.ee10.servlet.ServletContextHandler;
22+
import org.eclipse.jetty.ee10.servlet.ServletHolder;
2323
import org.eclipse.jetty.util.ssl.SslContextFactory;
24-
import javax.servlet.ServletException;
24+
import jakarta.servlet.ServletException;
2525
import java.util.List;
2626

2727
public class KafkaCruiseControlServletApp extends KafkaCruiseControlApp {
@@ -55,7 +55,7 @@ protected ServerConnector setupHttpConnector(String hostname, int port) {
5555
ServerConnector serverConnector;
5656
Boolean webserverSslEnable = _config.getBoolean(WebServerConfig.WEBSERVER_SSL_ENABLE_CONFIG);
5757
if (webserverSslEnable != null && webserverSslEnable) {
58-
SslContextFactory sslServerContextFactory = new SslContextFactory.Server();
58+
SslContextFactory.Server sslServerContextFactory = new SslContextFactory.Server();
5959
sslServerContextFactory.setKeyStorePath(_config.getString(WebServerConfig.WEBSERVER_SSL_KEYSTORE_LOCATION_CONFIG));
6060
sslServerContextFactory.setKeyStorePassword(_config.getPassword(WebServerConfig.WEBSERVER_SSL_KEYSTORE_PASSWORD_CONFIG).value());
6161
sslServerContextFactory.setKeyManagerPassword(_config.getPassword(WebServerConfig.WEBSERVER_SSL_KEY_PASSWORD_CONFIG).value());
@@ -124,7 +124,7 @@ protected void setupWebUi(ServletContextHandler contextHandler) {
124124
DefaultServlet defaultServlet = new DefaultServlet();
125125
ServletHolder holderWebapp = new ServletHolder("default", defaultServlet);
126126
// holderWebapp.setInitParameter("org.eclipse.jetty.servlet.Default.dirAllowed", "false");
127-
holderWebapp.setInitParameter("resourceBase", webuiDir);
127+
holderWebapp.setInitParameter("baseResource", webuiDir);
128128
contextHandler.addServlet(holderWebapp, webuiPathPrefix);
129129
}
130130

‎cruise-control/src/main/java/com/linkedin/kafka/cruisecontrol/KafkaCruiseControlUtils.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@
5454
import org.apache.kafka.common.serialization.Deserializer;
5555
import org.slf4j.Logger;
5656
import org.slf4j.LoggerFactory;
57-
import javax.servlet.ServletException;
57+
import jakarta.servlet.ServletException;
5858
import java.io.FileInputStream;
5959
import java.io.IOException;
6060
import java.io.InputStream;

‎cruise-control/src/main/java/com/linkedin/kafka/cruisecontrol/async/progress/OperationProgress.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
import java.util.Collections;
1111
import java.util.List;
1212
import java.util.Map;
13-
import javax.servlet.http.HttpSession;
13+
import jakarta.servlet.http.HttpSession;
1414

1515

1616
/**

‎cruise-control/src/main/java/com/linkedin/kafka/cruisecontrol/monitor/sampling/prometheus/PrometheusAdapter.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
import java.nio.charset.StandardCharsets;
1111
import java.util.ArrayList;
1212
import java.util.List;
13-
import javax.servlet.http.HttpServletResponse;
13+
import jakarta.servlet.http.HttpServletResponse;
1414
import org.apache.commons.io.IOUtils;
1515
import org.apache.http.HttpEntity;
1616
import org.apache.http.HttpHost;

‎cruise-control/src/main/java/com/linkedin/kafka/cruisecontrol/servlet/KafkaCruiseControlServletUtils.java‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,19 +17,19 @@
1717
import java.util.Collections;
1818
import java.util.HashMap;
1919
import java.util.Map;
20-
import javax.servlet.http.HttpServletRequest;
21-
import javax.servlet.http.HttpServletResponse;
20+
import jakarta.servlet.http.HttpServletRequest;
21+
import jakarta.servlet.http.HttpServletResponse;
2222

2323
import static com.linkedin.kafka.cruisecontrol.config.constants.CruiseControlParametersConfig.*;
2424
import static com.linkedin.kafka.cruisecontrol.config.constants.CruiseControlRequestConfig.*;
2525
import static com.linkedin.kafka.cruisecontrol.servlet.CruiseControlEndPoint.*;
2626
import static com.linkedin.kafka.cruisecontrol.servlet.parameters.ParameterUtils.*;
2727
import static com.linkedin.kafka.cruisecontrol.servlet.response.ResponseUtils.writeErrorResponse;
28-
import static javax.servlet.http.HttpServletResponse.SC_NOT_FOUND;
29-
import static javax.servlet.http.HttpServletResponse.SC_BAD_REQUEST;
30-
import static javax.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
31-
import static javax.servlet.http.HttpServletResponse.SC_FORBIDDEN;
32-
import static javax.servlet.http.HttpServletResponse.SC_OK;
28+
import static jakarta.servlet.http.HttpServletResponse.SC_NOT_FOUND;
29+
import static jakarta.servlet.http.HttpServletResponse.SC_BAD_REQUEST;
30+
import static jakarta.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
31+
import static jakarta.servlet.http.HttpServletResponse.SC_FORBIDDEN;
32+
import static jakarta.servlet.http.HttpServletResponse.SC_OK;
3333

3434

3535
/**

‎cruise-control/src/main/java/com/linkedin/kafka/cruisecontrol/servlet/ServletRequestContext.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@
1212
import com.linkedin.kafka.cruisecontrol.servlet.response.ResponseUtils;
1313
import io.vertx.core.MultiMap;
1414
import io.vertx.core.http.impl.headers.HeadersMultiMap;
15-
import javax.servlet.http.HttpServletRequest;
16-
import javax.servlet.http.HttpServletResponse;
15+
import jakarta.servlet.http.HttpServletRequest;
16+
import jakarta.servlet.http.HttpServletResponse;
1717
import java.io.IOException;
1818
import java.io.OutputStream;
1919
import java.nio.charset.StandardCharsets;

‎cruise-control/src/main/java/com/linkedin/kafka/cruisecontrol/servlet/ServletRequestHandler.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@
88
import com.linkedin.kafka.cruisecontrol.KafkaCruiseControlEndPoints;
99
import com.linkedin.kafka.cruisecontrol.KafkaCruiseControlRequestHandler;
1010
import com.linkedin.kafka.cruisecontrol.async.AsyncKafkaCruiseControl;
11-
import javax.servlet.http.HttpServlet;
12-
import javax.servlet.http.HttpServletRequest;
13-
import javax.servlet.http.HttpServletResponse;
11+
import jakarta.servlet.http.HttpServlet;
12+
import jakarta.servlet.http.HttpServletRequest;
13+
import jakarta.servlet.http.HttpServletResponse;
1414
import java.io.IOException;
1515

1616
import static com.linkedin.kafka.cruisecontrol.servlet.KafkaCruiseControlServletUtils.handleOptions;

‎cruise-control/src/main/java/com/linkedin/kafka/cruisecontrol/servlet/ServletSession.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
package com.linkedin.kafka.cruisecontrol.servlet;
66

77
import com.linkedin.cruisecontrol.http.CruiseControlHttpSession;
8-
import javax.servlet.http.HttpSession;
8+
import jakarta.servlet.http.HttpSession;
99
import java.util.Objects;
1010

1111
public class ServletSession implements CruiseControlHttpSession {

‎cruise-control/src/main/java/com/linkedin/kafka/cruisecontrol/servlet/UserPermissionsManager.java‎

Lines changed: 50 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,25 @@
44

55
package com.linkedin.kafka.cruisecontrol.servlet;
66

7+
import java.io.BufferedReader;
8+
import java.io.IOException;
9+
import java.io.InputStreamReader;
10+
import java.io.UncheckedIOException;
11+
import java.nio.charset.StandardCharsets;
712
import java.util.Map;
813
import java.util.Set;
914
import java.util.HashMap;
1015
import java.util.HashSet;
1116
import java.util.stream.Collectors;
1217
import java.util.Collections;
1318
import com.linkedin.kafka.cruisecontrol.config.KafkaCruiseControlConfig;
19+
import org.eclipse.jetty.security.RolePrincipal;
1420
import org.eclipse.jetty.security.UserStore;
1521
import org.eclipse.jetty.security.PropertyUserStore;
16-
import org.eclipse.jetty.security.AbstractLoginService;
1722
import com.linkedin.kafka.cruisecontrol.config.constants.WebServerConfig;
18-
import javax.security.auth.Subject;
23+
import org.eclipse.jetty.server.handler.ResourceHandler;
24+
import org.eclipse.jetty.util.resource.Resource;
25+
import org.eclipse.jetty.util.resource.ResourceFactory;
1926
import org.slf4j.Logger;
2027
import org.slf4j.LoggerFactory;
2128

@@ -39,23 +46,21 @@ public UserPermissionsManager(KafkaCruiseControlConfig config) {
3946
* @return a map of usernames -> their assigned roles
4047
*/
4148
private Map<String, Set<String>> createRolesPerUsersMap() {
42-
Map<String, Set<String>> rolesPerUsers = new HashMap();
49+
Map<String, Set<String>> rolesPerUsers = new HashMap<>();
4350
boolean securityEnabled = _config.getBoolean(WebServerConfig.WEBSERVER_SECURITY_ENABLE_CONFIG);
4451
if (securityEnabled) {
45-
String privilegedFilePath = _config.getString(WebServerConfig.WEBSERVER_AUTH_CREDENTIALS_FILE_CONFIG);
46-
UserStore userStore = createUserStoreFromFile(privilegedFilePath);
52+
String privilegesFilePath = _config.getString(WebServerConfig.WEBSERVER_AUTH_CREDENTIALS_FILE_CONFIG);
53+
Resource resource = ResourceFactory.of(new ResourceHandler()).newResource(privilegesFilePath);
54+
UserStore userStore = createUserStoreFromResource(resource);
4755
startUserStore(userStore);
4856

49-
Set<String> userNames = userStore.getKnownUserIdentities().keySet();
57+
Set<String> userNames = parseUsernames(resource);
5058

5159
for (String user : userNames) {
52-
Subject userSubject = userStore.getUserIdentity(user).getSubject();
53-
Set<AbstractLoginService.RolePrincipal> roles = userSubject == null
54-
? new HashSet<>()
55-
: userSubject.getPrincipals(AbstractLoginService.RolePrincipal.class);
60+
Set<RolePrincipal> roles = new HashSet<>(userStore.getRolePrincipals(user));
5661

5762
Set<String> roleNames = roles.stream()
58-
.map(AbstractLoginService.RolePrincipal::getName)
63+
.map(RolePrincipal::getName)
5964
.map(String::toUpperCase)
6065
.collect(Collectors.toSet());
6166
rolesPerUsers.put(user, roleNames);
@@ -94,12 +99,43 @@ public Set<String> getRolesBy(String userName) {
9499

95100
/** Creates UserStore from an external file
96101
*
97-
* @param privilegedFilePath a filepath containing user privileges information
102+
* @param privilegedResource a filepath containing user privileges information
98103
* @return a UserStore object
99104
*/
100-
private UserStore createUserStoreFromFile(String privilegedFilePath) {
105+
private UserStore createUserStoreFromResource(Resource privilegedResource) {
101106
PropertyUserStore userStore = new PropertyUserStore();
102-
userStore.setConfig(privilegedFilePath);
107+
userStore.setConfig(privilegedResource);
103108
return userStore;
104109
}
110+
111+
/** Creates a set of usernames from a Resource
112+
*
113+
* @param resource a Resource containing user privileges information
114+
* @return a Set of usernames parsed from the Resource
115+
*/
116+
private static Set<String> parseUsernames(Resource resource) {
117+
if (!resource.exists() || !resource.isReadable()) {
118+
return Set.of();
119+
}
120+
Set<String> usernames = new HashSet<>();
121+
try (BufferedReader reader = new BufferedReader(new InputStreamReader(resource.newInputStream(), StandardCharsets.UTF_8))) {
122+
String line;
123+
while ((line = reader.readLine()) != null) {
124+
line = line.trim();
125+
if (line.isEmpty() || line.startsWith("#")) {
126+
continue;
127+
}
128+
int colonIndex = line.indexOf(':');
129+
if (colonIndex != -1) {
130+
String username = line.substring(0, colonIndex).trim();
131+
if (!username.isEmpty()) {
132+
usernames.add(username);
133+
}
134+
}
135+
}
136+
} catch (IOException e) {
137+
throw new UncheckedIOException("Failed to read usernames from " + resource, e);
138+
}
139+
return usernames;
140+
}
105141
}

0 commit comments

Comments
 (0)