[OOZIE-2410] Fork collections-generic

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Won't Fix
• Affects Version/s: trunk
• Assignee: Robert Kanter
• Reporter: Robert Kanter
• Created: 02/Dec/15 02:01
• Updated: 03/Aug/16 18:55
• Resolved: 09/Dec/15 01:24

Description

The Jung library used by the GraphGenerator code is using an old fork of Commons-Collections which added generics. There was recently a security bug in Commons-Collections (COLLECTIONS-580). The fork we're using hasn't been updated since 2010 and is dead, so it won't get the security fix (Commons-Collections 3.2.2 or 4.1). While Oozie isn't currently vulnerable to an attack due to this, it would be good to patch this just to be safe.

Unfortunately, the best way to fix this is to fork the fork, which isn't super great. Anyway, we can make a new "oozie-collections-generic" module with the collections-generic code + the security fixes applied.

In the long run, we should implement OOZIE-2406, which will completely rewrite the GraphGenerator (there's a number of other downsides with the current implementation listed there), at which time we can remove this new module.

Issue Links

• is related to: OOZIE-2406 Completely rewrite GraphGenerator code