From b16de641609e06d2bed51d05d3ee153440fe351f Mon Sep 17 00:00:00 2001 From: satish Date: Wed, 25 Oct 2023 16:49:20 +0530 Subject: [PATCH 1/4] truncate Trino query error message to 2K --- .../core/query/service/trino/TrinoBasedRequestHandler.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/query-service-impl/src/main/java/org/hypertrace/core/query/service/trino/TrinoBasedRequestHandler.java b/query-service-impl/src/main/java/org/hypertrace/core/query/service/trino/TrinoBasedRequestHandler.java index 3f885536..e422da33 100644 --- a/query-service-impl/src/main/java/org/hypertrace/core/query/service/trino/TrinoBasedRequestHandler.java +++ b/query-service-impl/src/main/java/org/hypertrace/core/query/service/trino/TrinoBasedRequestHandler.java @@ -130,7 +130,8 @@ public Observable handleRequest(QueryRequest request, ExecutionContext exec return executeQuery(sql.getKey(), sql.getValue()); } catch (Throwable t) { - return Observable.error(t); + String truncatedMessage = (t.getMessage() == null) ? null : t.getMessage().substring(0, 2048); + return Observable.error(new Throwable(truncatedMessage)); } } From 66bf0693b66bd986f6db6d158880b77f2a545fa3 Mon Sep 17 00:00:00 2001 From: satish Date: Wed, 25 Oct 2023 16:57:34 +0530 Subject: [PATCH 2/4] fix vulnerabilities --- owasp-suppressions.xml | 5 +++-- query-service-client/build.gradle.kts | 2 +- query-service-factory/build.gradle.kts | 2 +- query-service-impl/build.gradle.kts | 11 +++++++---- query-service/build.gradle.kts | 6 +++--- 5 files changed, 15 insertions(+), 11 deletions(-) diff --git a/owasp-suppressions.xml b/owasp-suppressions.xml index c75b0137..42d6e7c2 100644 --- a/owasp-suppressions.xml +++ b/owasp-suppressions.xml @@ -18,14 +18,15 @@ CVE-2020-13956 - + ^pkg:maven/org\.apache\.helix/zookeeper\-api@.*$ CVE-2016-5017 CVE-2018-8012 CVE-2019-0201 + CVE-2023-44981 Date: Wed, 25 Oct 2023 22:25:07 +0530 Subject: [PATCH 3/4] handle indexOutOfBoundsException --- .../query/service/trino/TrinoBasedRequestHandler.java | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/query-service-impl/src/main/java/org/hypertrace/core/query/service/trino/TrinoBasedRequestHandler.java b/query-service-impl/src/main/java/org/hypertrace/core/query/service/trino/TrinoBasedRequestHandler.java index e422da33..2b61f14e 100644 --- a/query-service-impl/src/main/java/org/hypertrace/core/query/service/trino/TrinoBasedRequestHandler.java +++ b/query-service-impl/src/main/java/org/hypertrace/core/query/service/trino/TrinoBasedRequestHandler.java @@ -130,8 +130,7 @@ public Observable handleRequest(QueryRequest request, ExecutionContext exec return executeQuery(sql.getKey(), sql.getValue()); } catch (Throwable t) { - String truncatedMessage = (t.getMessage() == null) ? null : t.getMessage().substring(0, 2048); - return Observable.error(new Throwable(truncatedMessage)); + return Observable.error(new Throwable(truncateMessage(t.getMessage(), 2048))); } } @@ -229,4 +228,12 @@ private Value getNullValueEquivalent(int columnType) { return NULL_STRING_EQ_STRING_VALUE; } } + + private String truncateMessage(String message, int length) { + if (message == null) { + return null; + } else { + return message.length() <= length ? message : message.substring(0, length); + } + } } From cb03283a88c9d32f22b6a76a4ec601983985746b Mon Sep 17 00:00:00 2001 From: satish Date: Thu, 26 Oct 2023 10:35:19 +0530 Subject: [PATCH 4/4] use StringUtils --- .../query/service/trino/TrinoBasedRequestHandler.java | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/query-service-impl/src/main/java/org/hypertrace/core/query/service/trino/TrinoBasedRequestHandler.java b/query-service-impl/src/main/java/org/hypertrace/core/query/service/trino/TrinoBasedRequestHandler.java index 2b61f14e..690dcad3 100644 --- a/query-service-impl/src/main/java/org/hypertrace/core/query/service/trino/TrinoBasedRequestHandler.java +++ b/query-service-impl/src/main/java/org/hypertrace/core/query/service/trino/TrinoBasedRequestHandler.java @@ -19,6 +19,7 @@ import java.util.Optional; import java.util.Set; import lombok.SneakyThrows; +import org.apache.commons.lang3.StringUtils; import org.hypertrace.core.query.service.ExecutionContext; import org.hypertrace.core.query.service.QueryCost; import org.hypertrace.core.query.service.RequestHandler; @@ -130,7 +131,7 @@ public Observable handleRequest(QueryRequest request, ExecutionContext exec return executeQuery(sql.getKey(), sql.getValue()); } catch (Throwable t) { - return Observable.error(new Throwable(truncateMessage(t.getMessage(), 2048))); + return Observable.error(new Throwable(StringUtils.truncate(t.getMessage(), 2048))); } } @@ -228,12 +229,4 @@ private Value getNullValueEquivalent(int columnType) { return NULL_STRING_EQ_STRING_VALUE; } } - - private String truncateMessage(String message, int length) { - if (message == null) { - return null; - } else { - return message.length() <= length ? message : message.substring(0, length); - } - } }