From f97468b88f5dec4f047cdfa09c3d35920bbf4665 Mon Sep 17 00:00:00 2001
From: "Yu, Peng" <peng.yu@intel.com>
Date: Tue, 14 Dec 2021 19:26:17 +0800
Subject: [PATCH] [POAE7-1418] fix vulnerability introduced by log4j

---
 .github/workflows/ape_java.yaml     |  2 +-
 HCFS-based-cache/pom.xml            | 10 ++++++++
 Plasma-based-cache/pom.xml          | 36 +++++++++++++++++++++++++++++
 oap-ape/ape-java/ape-common/pom.xml | 13 ++++++++++-
 4 files changed, 59 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ape_java.yaml b/.github/workflows/ape_java.yaml
index 9d63dda12..53aca6faf 100644
--- a/.github/workflows/ape_java.yaml
+++ b/.github/workflows/ape_java.yaml
@@ -27,7 +27,7 @@ jobs:
           key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} # todo: which pom.xml?
           restore-keys: ${{ runner.os }}-m2
       - name: pmem-common dependency
-        run: cd /tmp; git clone https://github.com/oap-project/pmem-common.git; cd pmem-common/; mvn install -am -q -DskipTests
+        run: cd /tmp; git clone https://github.com/oap-project/pmem-common.git; cd pmem-common/; git checkout branch-1.1-spark-3.x; mvn install -am -q -DskipTests
       - name: ICL library dependency
         run: cd /tmp; git clone https://github.com/Intel-bigdata/IntelCodecLibrary; cd IntelCodecLibrary/; mvn clean install
       - name: Build with Maven
diff --git a/HCFS-based-cache/pom.xml b/HCFS-based-cache/pom.xml
index 015975ae1..14dbfd3a4 100644
--- a/HCFS-based-cache/pom.xml
+++ b/HCFS-based-cache/pom.xml
@@ -36,6 +36,16 @@
       <artifactId>hadoop-common</artifactId>
       <version>${hadoop.version}</version>
       <scope>provided</scope>
+      <exclusions>
+        <exclusion>
+          <groupId>log4j</groupId>
+          <artifactId>log4j</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.slf4j</groupId>
+          <artifactId>slf4j-log4j12</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.apache.hadoop</groupId>
diff --git a/Plasma-based-cache/pom.xml b/Plasma-based-cache/pom.xml
index b9c27cd19..b60d8e8af 100644
--- a/Plasma-based-cache/pom.xml
+++ b/Plasma-based-cache/pom.xml
@@ -131,6 +131,10 @@
           <groupId>io.pmem</groupId>
           <artifactId>libpmemkv-jni</artifactId>
         </exclusion>
+        <exclusion>
+          <groupId>org.slf4j</groupId>
+          <artifactId>slf4j-log4j12</artifactId>
+        </exclusion>
       </exclusions>
     </dependency>
     <dependency>
@@ -213,6 +217,16 @@
       <groupId>org.apache.spark</groupId>
       <artifactId>spark-core_${scala.binary.version}</artifactId>
       <version>${spark.internal.version}</version>
+      <exclusions>
+        <exclusion>
+          <groupId>log4j</groupId>
+          <artifactId>log4j</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.slf4j</groupId>
+          <artifactId>slf4j-log4j12</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.apache.spark</groupId>
@@ -220,6 +234,28 @@
       <version>${spark.internal.version}</version>
       <type>test-jar</type>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <groupId>log4j</groupId>
+          <artifactId>log4j</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.slf4j</groupId>
+          <artifactId>slf4j-log4j12</artifactId>
+        </exclusion>
+      </exclusions>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.logging.log4j</groupId>
+      <artifactId>log4j-slf4j-impl</artifactId>
+      <version>2.15.0</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.logging.log4j</groupId>
+      <artifactId>log4j-1.2-api</artifactId>
+      <version>2.15.0</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.apache.spark</groupId>
diff --git a/oap-ape/ape-java/ape-common/pom.xml b/oap-ape/ape-java/ape-common/pom.xml
index 709fc56ed..e5e8b62d3 100644
--- a/oap-ape/ape-java/ape-common/pom.xml
+++ b/oap-ape/ape-java/ape-common/pom.xml
@@ -89,7 +89,18 @@
     <dependency>
       <groupId>com.intel.oap</groupId>
       <artifactId>pmem-common</artifactId>
-      <version>1.2.0-snapshot</version>
+      <version>1.1.0</version>
+      <exclusions>
+        <exclusion>
+          <groupId>org.slf4j</groupId>
+          <artifactId>slf4j-log4j12</artifactId>
+        </exclusion>
+      </exclusions>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.logging.log4j</groupId>
+      <artifactId>log4j-slf4j-impl</artifactId>
+      <version>2.15.0</version>
     </dependency>
     <dependency>
       <groupId>org.apache.parquet</groupId>