From 3195e593c0618e80290ef86a7b05ebd84190e4c3 Mon Sep 17 00:00:00 2001 From: "jingchun.xia" <6269380+xiajingchun@users.noreply.github.com> Date: Thu, 3 Sep 2026 19:48:48 +0800 Subject: [PATCH 1/2] Remove Fastjson from the driver (#656) Replace Fastjson authentication option serialization with a local string-map JSON serializer and remove the Fastjson dependency. Keep the gRPC and Protobuf vulnerability updates in the same security change. --- client/pom.xml | 18 ++---- .../driver/graph/net/GrpcConnection.java | 59 ++++++++++++++++++- 2 files changed, 63 insertions(+), 14 deletions(-) diff --git a/client/pom.xml b/client/pom.xml index 505ba5211..b448ccc20 100644 --- a/client/pom.xml +++ b/client/pom.xml @@ -25,7 +25,6 @@ 1.13 2.2 3.0.1 - 1.2.83 1.69 UTF-8 1.16.1 @@ -80,11 +79,6 @@ javax.servlet-api ${servlet.version} - - com.alibaba - fastjson - ${fastjson.version} - org.bouncycastle bcpkix-jdk15on @@ -98,22 +92,22 @@ io.grpc grpc-netty-shaded - 1.60.0 + 1.75.0 io.grpc grpc-protobuf - 1.60.0 + 1.75.0 io.grpc grpc-stub - 1.60.0 + 1.75.0 com.google.protobuf protobuf-java - 3.25.1 + 3.25.5 @@ -192,9 +186,9 @@ protobuf-maven-plugin 0.6.1 - com.google.protobuf:protoc:3.25.1:exe:${os.detected.classifier} + com.google.protobuf:protoc:3.25.5:exe:${os.detected.classifier} grpc-java - io.grpc:protoc-gen-grpc-java:1.60.0:exe:${os.detected.classifier} + io.grpc:protoc-gen-grpc-java:1.75.0:exe:${os.detected.classifier} diff --git a/client/src/main/java/com/vesoft/nebula/driver/graph/net/GrpcConnection.java b/client/src/main/java/com/vesoft/nebula/driver/graph/net/GrpcConnection.java index b9365fcbb..47e7e676c 100644 --- a/client/src/main/java/com/vesoft/nebula/driver/graph/net/GrpcConnection.java +++ b/client/src/main/java/com/vesoft/nebula/driver/graph/net/GrpcConnection.java @@ -7,7 +7,6 @@ import static com.vesoft.nebula.driver.graph.exception.IOErrorException.E_TIME_OUT; -import com.alibaba.fastjson.JSON; import com.google.common.base.Charsets; import com.google.protobuf.ByteString; import com.vesoft.nebula.driver.graph.ErrorCode; @@ -30,6 +29,7 @@ import io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder; import java.nio.charset.Charset; import java.util.Map; +import java.util.Map.Entry; import java.util.concurrent.TimeUnit; import javax.net.ssl.SSLException; import org.slf4j.Logger; @@ -108,7 +108,7 @@ public AuthResult authenticate(String user, Map authOptions) .build(); ByteString userString = user == null ? ByteString.copyFrom("", charset) : ByteString.copyFrom(user, charset); - String authInfoString = JSON.toJSONString(authOptions); + String authInfoString = toJsonString(authOptions); AuthRequest authReq = AuthRequest.newBuilder() .setUsername(userString) .setAuthInfo(ByteString.copyFrom(authInfoString, charset)) @@ -140,6 +140,61 @@ public AuthResult authenticate(String user, Map authOptions) } } + static String toJsonString(Map options) { + if (options == null) { + return "null"; + } + StringBuilder json = new StringBuilder("{"); + boolean first = true; + for (Entry entry : options.entrySet()) { + if (!first) { + json.append(','); + } + appendJsonString(json, entry.getKey()); + json.append(':'); + appendJsonString(json, String.valueOf(entry.getValue())); + first = false; + } + return json.append('}').toString(); + } + + private static void appendJsonString(StringBuilder json, String value) { + json.append('"'); + for (int index = 0; index < value.length(); index++) { + char character = value.charAt(index); + switch (character) { + case '"': + json.append("\\\""); + break; + case '\\': + json.append("\\\\"); + break; + case '\b': + json.append("\\b"); + break; + case '\f': + json.append("\\f"); + break; + case '\n': + json.append("\\n"); + break; + case '\r': + json.append("\\r"); + break; + case '\t': + json.append("\\t"); + break; + default: + if (character < 0x20) { + json.append(String.format("\\u%04x", (int) character)); + } else { + json.append(character); + } + } + } + json.append('"'); + } + public ExecuteResponse execute(long sessionID, String stmt, long timeout) throws IOErrorException { if (stmt == null) { From 008339e7f9f710708a533aa9e76f9fab961323b3 Mon Sep 17 00:00:00 2001 From: Anqi <16240361+Nicole00@users.noreply.github.com> Date: Thu, 3 Sep 2026 19:51:18 +0800 Subject: [PATCH 2/2] update version --- client/pom.xml | 2 +- .../com/vesoft/nebula/driver/graph/utils/ClientVersion.java | 2 +- examples/dependency-reduced-pom.xml | 2 +- examples/pom.xml | 2 +- pom.xml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/client/pom.xml b/client/pom.xml index b448ccc20..d9af93f34 100644 --- a/client/pom.xml +++ b/client/pom.xml @@ -6,7 +6,7 @@ com.vesoft nebula - 5.3.0 + 5.3.1 driver diff --git a/client/src/main/java/com/vesoft/nebula/driver/graph/utils/ClientVersion.java b/client/src/main/java/com/vesoft/nebula/driver/graph/utils/ClientVersion.java index 64203d358..f072d59bb 100644 --- a/client/src/main/java/com/vesoft/nebula/driver/graph/utils/ClientVersion.java +++ b/client/src/main/java/com/vesoft/nebula/driver/graph/utils/ClientVersion.java @@ -6,5 +6,5 @@ package com.vesoft.nebula.driver.graph.utils; public class ClientVersion { - public static final String clientVersion = "5.3.0"; + public static final String clientVersion = "5.3.1"; } diff --git a/examples/dependency-reduced-pom.xml b/examples/dependency-reduced-pom.xml index d42b8bd70..806b71d42 100644 --- a/examples/dependency-reduced-pom.xml +++ b/examples/dependency-reduced-pom.xml @@ -3,7 +3,7 @@ nebula com.vesoft - 5.3.0 + 5.3.1 4.0.0 org.example diff --git a/examples/pom.xml b/examples/pom.xml index f634e092d..2f9a53ffa 100644 --- a/examples/pom.xml +++ b/examples/pom.xml @@ -6,7 +6,7 @@ com.vesoft nebula - 5.3.0 + 5.3.1 org.example diff --git a/pom.xml b/pom.xml index 3672d8787..520124af2 100644 --- a/pom.xml +++ b/pom.xml @@ -6,7 +6,7 @@ com.vesoft nebula - 5.3.0 + 5.3.1 pom client