Skip to content

Commit 0bc8628

Browse files
dai-chendai-chen
authored
Bump org.json dependency version (#1586)
* Bump org.json version for CVE Signed-off-by: Chen Dai <daichen@amazon.com> * Fix assertion by json array similar method Signed-off-by: Chen Dai <daichen@amazon.com> * Fix more assertions which failed on query path return BigDecimal Signed-off-by: Chen Dai <daichen@amazon.com> * Fix legacy expr value factory Signed-off-by: Chen Dai <daichen@amazon.com> --------- Signed-off-by: Chen Dai <daichen@amazon.com>
1 parent 0db150b commit 0bc8628

10 files changed

Lines changed: 30 additions & 44 deletions

File tree

‎integ-test/src/test/java/org/opensearch/sql/legacy/AggregationIT.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
import static org.opensearch.sql.util.MatcherUtils.verifySchema;
2323

2424
import java.io.IOException;
25+
import java.math.BigDecimal;
2526
import java.util.Arrays;
2627
import java.util.HashMap;
2728
import java.util.HashSet;
@@ -1029,7 +1030,7 @@ public void minOnNestedField() throws Exception {
10291030
TEST_INDEX_NESTED_TYPE);
10301031
JSONObject result = executeQuery(query);
10311032
JSONObject aggregation = getAggregation(result, "message.dayOfWeek@NESTED");
1032-
Assert.assertEquals(1.0, (double) aggregation.query("/minDays/value"), 0.0001);
1033+
Assert.assertEquals(1.0, ((BigDecimal) aggregation.query("/minDays/value")).doubleValue(), 0.0001);
10331034
}
10341035

10351036
@Test
@@ -1039,7 +1040,7 @@ public void sumOnNestedField() throws Exception {
10391040
TEST_INDEX_NESTED_TYPE);
10401041
JSONObject result = executeQuery(query);
10411042
JSONObject aggregation = getAggregation(result, "message.dayOfWeek@NESTED");
1042-
Assert.assertEquals(19.0, (double) aggregation.query("/sumDays/value"), 0.0001);
1043+
Assert.assertEquals(19.0, ((BigDecimal) aggregation.query("/sumDays/value")).doubleValue(), 0.0001);
10431044
}
10441045

10451046
@Test

‎integ-test/src/test/java/org/opensearch/sql/legacy/NestedFieldQueryIT.java‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
import static org.opensearch.sql.util.MatcherUtils.kvString;
1717

1818
import java.io.IOException;
19+
import java.math.BigDecimal;
1920
import java.util.ArrayList;
2021
import java.util.function.Function;
2122
import org.hamcrest.BaseMatcher;
@@ -316,7 +317,7 @@ public void aggregationWithoutGroupBy() throws IOException {
316317
JSONObject result = executeQuery(sql);
317318
JSONObject aggregation = getAggregation(result, "message.dayOfWeek@NESTED");
318319

319-
Assert.assertThat((Double) aggregation.query("/avgDay/value"), closeTo(3.166666666, 0.01));
320+
Assert.assertThat(((BigDecimal) aggregation.query("/avgDay/value")).doubleValue(), closeTo(3.166666666, 0.01));
320321
}
321322

322323
@Test
@@ -350,10 +351,10 @@ public void groupByRegularFieldAndSum() throws IOException {
350351
Assert.assertNotNull(msgInfoBuckets);
351352
Assert.assertThat(msgInfoBuckets.length(), equalTo(2));
352353
Assert.assertThat(msgInfoBuckets.query("/0/key"), equalTo("a"));
353-
Assert.assertThat((Double) msgInfoBuckets.query("/0/message.dayOfWeek@NESTED/sumDay/value"),
354+
Assert.assertThat(((BigDecimal) msgInfoBuckets.query("/0/message.dayOfWeek@NESTED/sumDay/value")).doubleValue(),
354355
closeTo(9.0, 0.01));
355356
Assert.assertThat(msgInfoBuckets.query("/1/key"), equalTo("b"));
356-
Assert.assertThat((Double) msgInfoBuckets.query("/1/message.dayOfWeek@NESTED/sumDay/value"),
357+
Assert.assertThat(((BigDecimal) msgInfoBuckets.query("/1/message.dayOfWeek@NESTED/sumDay/value")).doubleValue(),
357358
closeTo(10.0, 0.01));
358359
}
359360

@@ -593,12 +594,12 @@ public void maxAggOnNestedInnerFieldWithoutWhere() throws IOException {
593594
Assert.assertThat(bucket.length(), equalTo(2));
594595
Assert.assertThat(bucket.query("/0/key"), equalTo("Bob Smith"));
595596
Assert.assertThat(
596-
bucket.query("/0/projects.started_year@NESTED/projects.started_year@FILTER/max/value"),
597-
equalTo(2015.0));
597+
((BigDecimal) bucket.query("/0/projects.started_year@NESTED/projects.started_year@FILTER/max/value")).doubleValue(),
598+
closeTo(2015.0, 0.01));
598599
Assert.assertThat(bucket.query("/1/key"), equalTo("Jane Smith"));
599600
Assert.assertThat(
600-
bucket.query("/1/projects.started_year@NESTED/projects.started_year@FILTER/max/value"),
601-
equalTo(2015.0));
601+
((BigDecimal) bucket.query("/1/projects.started_year@NESTED/projects.started_year@FILTER/max/value")).doubleValue(),
602+
closeTo(2015.0, 0.01));
602603
}
603604

604605
@Test
@@ -780,12 +781,12 @@ public void havingMaxAggOnNestedInnerFieldWithoutWhere() throws IOException {
780781
Assert.assertThat(bucket.length(), equalTo(2));
781782
Assert.assertThat(bucket.query("/0/key"), equalTo("Bob Smith"));
782783
Assert.assertThat(
783-
bucket.query("/0/projects.started_year@NESTED/projects.started_year@FILTER/max_0/value"),
784-
equalTo(2015.0));
784+
((BigDecimal) bucket.query("/0/projects.started_year@NESTED/projects.started_year@FILTER/max_0/value")).doubleValue(),
785+
closeTo(2015.0, 0.01));
785786
Assert.assertThat(bucket.query("/1/key"), equalTo("Jane Smith"));
786787
Assert.assertThat(
787-
bucket.query("/1/projects.started_year@NESTED/projects.started_year@FILTER/max_0/value"),
788-
equalTo(2015.0));
788+
((BigDecimal) bucket.query("/1/projects.started_year@NESTED/projects.started_year@FILTER/max_0/value")).doubleValue(),
789+
closeTo(2015.0, 0.01));
789790
}
790791

791792
/***********************************************************

‎integ-test/src/test/java/org/opensearch/sql/legacy/SubqueryIT.java‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
package org.opensearch.sql.legacy;
88

99
import static org.hamcrest.Matchers.both;
10+
import static org.hamcrest.Matchers.closeTo;
1011
import static org.hamcrest.Matchers.equalTo;
1112
import static org.hamcrest.core.Is.is;
1213
import static org.opensearch.sql.legacy.TestsConstants.TEST_INDEX_ACCOUNT;
@@ -22,6 +23,7 @@
2223

2324
import com.google.common.collect.Ordering;
2425
import java.io.IOException;
26+
import java.math.BigDecimal;
2527
import java.util.ArrayList;
2628
import java.util.List;
2729
import java.util.Locale;
@@ -345,7 +347,8 @@ public void selectFromSubqueryCountAndSum() throws IOException {
345347
TEST_INDEX_ACCOUNT));
346348

347349
assertThat(result.query("/aggregations/count/value"), equalTo(1000));
348-
assertThat(result.query("/aggregations/balance/value"), equalTo(25714837.0));
350+
assertThat(((BigDecimal) result.query("/aggregations/balance/value")).doubleValue(),
351+
closeTo(25714837.0, 0.01));
349352
}
350353

351354
@Test

‎integ-test/src/test/java/org/opensearch/sql/util/MatcherUtils.java‎

Lines changed: 3 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121

2222
import com.google.common.base.Strings;
2323
import com.google.gson.JsonParser;
24+
import java.math.BigDecimal;
2425
import java.util.ArrayList;
2526
import java.util.Arrays;
2627
import java.util.List;
@@ -121,7 +122,7 @@ public static Matcher<JSONObject> kvString(String key, Matcher<String> matcher)
121122
}
122123

123124
public static Matcher<JSONObject> kvDouble(String key, Matcher<Double> matcher) {
124-
return featureValueOf("Json Match", matcher, actual -> (Double) actual.query(key));
125+
return featureValueOf("Json Match", matcher, actual -> ((BigDecimal) actual.query(key)).doubleValue());
125126
}
126127

127128
public static Matcher<JSONObject> kvInt(String key, Matcher<Integer> matcher) {
@@ -231,30 +232,7 @@ public void describeTo(Description description) {
231232

232233
@Override
233234
protected boolean matchesSafely(JSONArray array) {
234-
if (array.length() != expectedObjects.length) {
235-
return false;
236-
}
237-
238-
for (int i = 0; i < expectedObjects.length; i++) {
239-
Object expected = expectedObjects[i];
240-
boolean isEqual;
241-
242-
// Use similar() because JSONObject/JSONArray.equals() only check if same reference
243-
if (expected instanceof JSONObject) {
244-
isEqual = ((JSONObject) expected).similar(array.get(i));
245-
} else if (expected instanceof JSONArray) {
246-
isEqual = ((JSONArray) expected).similar(array.get(i));
247-
} else if (null == expected) {
248-
isEqual = JSONObject.NULL == array.get(i);
249-
} else {
250-
isEqual = expected.equals(array.get(i));
251-
}
252-
253-
if (!isEqual) {
254-
return false;
255-
}
256-
}
257-
return true;
235+
return array.similar(new JSONArray(expectedObjects));
258236
}
259237
};
260238
}

‎legacy/build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ dependencies {
8989
}
9090
}
9191
implementation group: 'com.google.guava', name: 'guava', version: '31.0.1-jre'
92-
implementation group: 'org.json', name: 'json', version:'20180813'
92+
implementation group: 'org.json', name: 'json', version:'20230227'
9393
implementation group: 'org.apache.commons', name: 'commons-lang3', version: '3.12.0'
9494
implementation group: 'org.opensearch', name: 'opensearch', version: "${opensearch_version}"
9595
// add geo module as dependency. https://github.com/opensearch-project/OpenSearch/pull/4180/.

‎legacy/src/main/java/org/opensearch/sql/legacy/expression/model/ExprValueFactory.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66

77
package org.opensearch.sql.legacy.expression.model;
88

9+
import java.math.BigDecimal;
910
import java.util.ArrayList;
1011
import java.util.HashMap;
1112
import java.util.List;
@@ -61,6 +62,8 @@ public static ExprValue from(Object o) {
6162
return booleanValue((Boolean) o);
6263
} else if (o instanceof Double) {
6364
return doubleValue((Double) o);
65+
} else if (o instanceof BigDecimal) {
66+
return doubleValue(((BigDecimal) o).doubleValue());
6467
} else if (o instanceof String) {
6568
return stringValue((String) o);
6669
} else {

‎opensearch/build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ dependencies {
3535
implementation group: 'com.fasterxml.jackson.core', name: 'jackson-core', version: "${versions.jackson}"
3636
implementation group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: "${versions.jackson_databind}"
3737
implementation group: 'com.fasterxml.jackson.dataformat', name: 'jackson-dataformat-cbor', version: "${versions.jackson}"
38-
implementation group: 'org.json', name: 'json', version:'20180813'
38+
implementation group: 'org.json', name: 'json', version:'20230227'
3939
compileOnly group: 'org.opensearch.client', name: 'opensearch-rest-high-level-client', version: "${opensearch_version}"
4040
implementation group: 'org.opensearch', name:'opensearch-ml-client', version: "${opensearch_build}"
4141

‎ppl/build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ dependencies {
4848

4949
implementation "org.antlr:antlr4-runtime:4.7.1"
5050
implementation group: 'com.google.guava', name: 'guava', version: '31.0.1-jre'
51-
api group: 'org.json', name: 'json', version: '20180813'
51+
api group: 'org.json', name: 'json', version: '20230227'
5252
implementation group: 'org.apache.logging.log4j', name: 'log4j-core', version:'2.17.1'
5353
api project(':common')
5454
api project(':core')

‎prometheus/build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ dependencies {
2525
implementation 'com.github.babbel:okhttp-aws-signer:1.0.2'
2626
implementation group: 'com.amazonaws', name: 'aws-java-sdk-core', version: '1.12.1'
2727
implementation group: 'com.amazonaws', name: 'aws-java-sdk-sts', version: '1.12.1'
28-
implementation group: 'org.json', name: 'json', version: '20180813'
28+
implementation group: 'org.json', name: 'json', version: '20230227'
2929

3030
testImplementation('org.junit.jupiter:junit-jupiter:5.6.2')
3131
testImplementation group: 'org.hamcrest', name: 'hamcrest-library', version: '2.1'

‎sql/build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ dependencies {
4646

4747
implementation "org.antlr:antlr4-runtime:4.7.1"
4848
implementation group: 'com.google.guava', name: 'guava', version: '31.0.1-jre'
49-
implementation group: 'org.json', name: 'json', version:'20180813'
49+
implementation group: 'org.json', name: 'json', version:'20230227'
5050
implementation project(':common')
5151
implementation project(':core')
5252
api project(':protocol')

0 commit comments

Comments
 (0)