Repository navigation
fix(deps): upgrade protobuf-java and protobuf-java-util to 3.25.5 - #1117
Conversation
Fixes CVE-2024-7254 (CVSS 8.7): stack overflow via infinite recursion when parsing deeply nested groups or SGROUP tags as unknown fields using DiscardUnknownFieldsParser, Java Protobuf Lite parser, or against Protobuf map fields. An attacker can trigger this by sending a malicious serialized protobuf payload. Fixed in protobuf-java 3.25.5. Stays within the 3.x line for compatibility with the existing generated proto stubs in src/gen/java (generated with protoc 3.11.0). The protobuf runtime library is backward compatible within major versions.
abhishekj720
changed the title
…5 build Protobuf-generated sources (internalGetMapField, internalGetMutableMapField, LazyStringArrayList.EMPTY) use APIs deprecated in protobuf 3.22+. With -Werror, javac promotes the 96 deprecation warnings to a build failure. Remove -Xlint:deprecation from compileJava. Deprecation checks on hand-written sources are already enforced by errorprone, which excludes generated-sources via excludedPaths. This restores the same effective coverage without breaking the build on generated code. Signed-off-by: abhishek.jha <abhishek.jha@uber.com>
Code Review ✅ Approved🟡 Medium risk · Upgrading the protobuf runtime across the client could alter parsing or wire compatibility, causing failures when existing generated stubs handle messages. Upgrades Verification Repos 1 inspectedFunctional validation No results Rules No rules evaluated Broader impact Repos 1 inspectedCross-repo 1 repository inspected 0 open impacts
For more verification details, comment OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
Codecov Report✅ All modified and coverable lines are covered by tests. ❌ Your project check has failed because the head coverage (68.95%) is below the target coverage (85.00%). You can increase the head coverage or adjust the target coverage. Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
| compileJava { | ||
| dependsOn 'googleJavaFormat' | ||
| options.encoding = 'UTF-8' | ||
| options.compilerArgs << '-Xlint:none' << '-Xlint:deprecation' << '-Werror' |
There was a problem hiding this comment.
Yes, intentional.
Protobuf 3.25.5 deprecated some internal APIs used by our generated stubs (produced by protoc 3.11.0), which with -Werror turns into a build failure. Removing -Xlint:deprecation from javac is safe since errorprone already covers deprecation on hand-written code and excludes generated sources.
2 participants
Summary
Upgrades
com.google.protobuf:protobuf-javaandcom.google.protobuf:protobuf-java-utilfrom3.21.9to3.25.5.Stays within the
3.xline for compatibility with the existing generated proto stubs insrc/gen/java/(produced byprotoc 3.11.0). The protobuf Java runtime is backward compatible within major versions.Vulnerabilities fixed
SGROUPtags as unknown fields viaDiscardUnknownFieldsParser, Java Protobuf Lite parser, or against map fields. An attacker can send a malicious serialized payload to crash the JVM.Type of Change
Data Effect
Detailed Description
protobuf-java 3.25.5is a drop-in replacement for3.21.9. The protobuf project maintains backward compatibility within major versions — wire format, generated code API, and runtime API are all preserved.protobuf-java-utilis versioned alongsideprotobuf-javaand is bumped to match.No proto regeneration is required: the generated stubs in
src/gen/java/were produced byprotoc 3.11.0and remain compatible with the3.25.5runtime.Impact Analysis
Testing Plan
Rollout Plan
Standard release. No special rollout required.