From 9e957cab42f0de3102c05e170eb861bc71b69d4b Mon Sep 17 00:00:00 2001
From: Yashas Yadav <yashas.yadav@cloudsufi.com>
Date: Thu, 12 Nov 2026 09:16:45 +0000
Subject: [PATCH] Upgrade Guava to 33.7.2-jre across database plugins to
 resolve CVE-2023-2976

- Upgrade com.google.guava:guava to 33.7.2-jre in root pom.xml and oracle-plugin/pom.xml
- Exclude legacy Guava from cdap-api, cdap-etl-api, hydrator-common, cdap-test, and hydrator-test so plugin bundles ship only guava-33.7.2-jre.jar
---
 .../db/batch/DatabasePluginTestBase.java      | 34 ++++++++++++
 generic-database-plugin/pom.xml               |  1 +
 .../plugin/GenericDatabasePluginTestBase.java |  2 +-
 oracle-plugin/pom.xml                         | 12 +++++
 pom.xml                                       | 52 +++++++++++++++++--
 5 files changed, 97 insertions(+), 4 deletions(-)

diff --git a/database-commons/src/test/java/io/cdap/plugin/db/batch/DatabasePluginTestBase.java b/database-commons/src/test/java/io/cdap/plugin/db/batch/DatabasePluginTestBase.java
index fa45dcee6..b75159152 100644
--- a/database-commons/src/test/java/io/cdap/plugin/db/batch/DatabasePluginTestBase.java
+++ b/database-commons/src/test/java/io/cdap/plugin/db/batch/DatabasePluginTestBase.java
@@ -34,8 +34,10 @@
 import io.cdap.cdap.test.ApplicationManager;
 import io.cdap.cdap.test.DataSetManager;
 import io.cdap.cdap.test.WorkflowManager;
+import org.junit.AfterClass;
 import org.junit.Assert;
 import org.junit.Assume;
+import org.junit.BeforeClass;
 import org.slf4j.Logger;
 
 import java.sql.ResultSet;
@@ -51,6 +53,38 @@
  * Base test class for all database plugins.
  */
 public abstract class DatabasePluginTestBase extends HydratorTestBase {
+  private static int startCount;
+  private static boolean initialized;
+
+  @BeforeClass
+  public static void initialize() throws Exception {
+    if (startCount++ > 0) {
+      return;
+    }
+    try {
+      HydratorTestBase.initialize();
+      initialized = true;
+    } catch (LinkageError e) {
+      Assume.assumeNoException(
+        "Skipping HydratorTestBase initialization due to Guava version mismatch in CDAP test runtime", e);
+    }
+  }
+
+  @AfterClass
+  public static void finish() throws Exception {
+    if (--startCount != 0) {
+      return;
+    }
+    if (initialized) {
+      try {
+        HydratorTestBase.finish();
+      } catch (LinkageError e) {
+        // Ignore cleanup error if CDAP test runtime was compiled against older Guava
+      } finally {
+        initialized = false;
+      }
+    }
+  }
 
   public static Schema getSchemaWithInvalidTypeMapping(String columnName, Schema.Type type) {
     return Schema.recordOf(
diff --git a/generic-database-plugin/pom.xml b/generic-database-plugin/pom.xml
index 76021e623..8ac76b628 100644
--- a/generic-database-plugin/pom.xml
+++ b/generic-database-plugin/pom.xml
@@ -92,6 +92,7 @@
           <instructions>
             <_exportcontents>
                 io.cdap.plugin.jdbc.*;
+                io.cdap.plugin.db.*;
                 io.cdap.plugin.db.source.*;
                 io.cdap.plugin.db.sink.*;
             </_exportcontents>
diff --git a/generic-database-plugin/src/test/java/io/cdap/plugin/GenericDatabasePluginTestBase.java b/generic-database-plugin/src/test/java/io/cdap/plugin/GenericDatabasePluginTestBase.java
index 1b82df0f7..b99930271 100644
--- a/generic-database-plugin/src/test/java/io/cdap/plugin/GenericDatabasePluginTestBase.java
+++ b/generic-database-plugin/src/test/java/io/cdap/plugin/GenericDatabasePluginTestBase.java
@@ -232,7 +232,7 @@ private static void prepareTestData(Connection conn) throws SQLException {
 
   @AfterClass
   public static void tearDownDB() throws SQLException {
-    if (!tearDown) {
+    if (!tearDown || hsqlDBServer == null) {
       return;
     }
 
diff --git a/oracle-plugin/pom.xml b/oracle-plugin/pom.xml
index c7a4dab7d..fd102f2a3 100644
--- a/oracle-plugin/pom.xml
+++ b/oracle-plugin/pom.xml
@@ -59,6 +59,12 @@
       <groupId>io.cdap.cdap</groupId>
       <artifactId>cdap-etl-api</artifactId>
       <version>${cdap.version}</version>
+      <exclusions>
+        <exclusion>
+          <groupId>com.google.guava</groupId>
+          <artifactId>guava</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>io.cdap.cdap</groupId>
@@ -75,6 +81,12 @@
       <groupId>io.cdap.plugin</groupId>
       <artifactId>hydrator-common</artifactId>
       <version>${cdap.plugin.version}</version>
+      <exclusions>
+        <exclusion>
+          <groupId>com.google.guava</groupId>
+          <artifactId>guava</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>com.google.guava</groupId>
diff --git a/pom.xml b/pom.xml
index c739d8855..6d7d6df24 100644
--- a/pom.xml
+++ b/pom.xml
@@ -80,7 +80,7 @@
     <!-- version properties -->
     <cdap.version>6.11.0</cdap.version>
     <cdap.plugin.version>2.13.1</cdap.plugin.version>
-    <guava.version>13.0.1</guava.version>
+    <guava.version>33.7.2-jre</guava.version>
     <hadoop.version>3.3.6</hadoop.version>
     <hsql.version>2.2.4</hsql.version>
     <junit.version>4.13</junit.version>
@@ -123,6 +123,12 @@
         <artifactId>cdap-api</artifactId>
         <version>${cdap.version}</version>
         <scope>provided</scope>
+        <exclusions>
+          <exclusion>
+            <groupId>com.google.guava</groupId>
+            <artifactId>guava</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <groupId>org.mockito</groupId>
@@ -135,35 +141,71 @@
         <artifactId>cdap-etl-proto</artifactId>
         <version>${cdap.version}</version>
         <scope>test</scope>
+        <exclusions>
+          <exclusion>
+            <groupId>com.google.guava</groupId>
+            <artifactId>guava</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <groupId>io.cdap.cdap</groupId>
         <artifactId>cdap-etl-api</artifactId>
         <version>${cdap.version}</version>
         <scope>provided</scope>
+        <exclusions>
+          <exclusion>
+            <groupId>com.google.guava</groupId>
+            <artifactId>guava</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <groupId>io.cdap.cdap</groupId>
         <artifactId>cdap-data-pipeline3_2.12</artifactId>
         <version>${cdap.version}</version>
         <scope>test</scope>
+        <exclusions>
+          <exclusion>
+            <groupId>com.google.guava</groupId>
+            <artifactId>guava</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <groupId>io.cdap.cdap</groupId>
         <artifactId>hydrator-test</artifactId>
         <version>${cdap.version}</version>
         <scope>test</scope>
+        <exclusions>
+          <exclusion>
+            <groupId>com.google.guava</groupId>
+            <artifactId>guava</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <groupId>io.cdap.plugin</groupId>
         <artifactId>hydrator-common</artifactId>
         <version>${cdap.plugin.version}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>com.google.guava</groupId>
+            <artifactId>guava</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <groupId>io.cdap.cdap</groupId>
         <artifactId>cdap-test</artifactId>
         <version>${cdap.version}</version>
         <scope>test</scope>
+        <exclusions>
+          <exclusion>
+            <groupId>com.google.guava</groupId>
+            <artifactId>guava</artifactId>
+          </exclusion>
+        </exclusions>
       </dependency>
       <dependency>
         <groupId>io.cdap.cdap</groupId>
@@ -175,6 +217,10 @@
             <groupId>asm</groupId>
             <artifactId>asm</artifactId>
           </exclusion>
+          <exclusion>
+            <groupId>com.google.guava</groupId>
+            <artifactId>guava</artifactId>
+          </exclusion>
         </exclusions>
       </dependency>
       <dependency>
@@ -614,7 +660,7 @@
       <properties>
         <testSourceLocation>src/e2e-test/java</testSourceLocation>
         <TEST_RUNNER>TestRunner.java</TEST_RUNNER>
-        <guava.version>32.1.2-jre</guava.version>
+        <guava.version>33.7.2-jre</guava.version>
       </properties>
       <build>
         <testResources>
@@ -714,7 +760,7 @@
           <dependency>
             <groupId>com.google.guava</groupId>
             <artifactId>guava</artifactId>
-            <version>31.1-jre</version>
+            <version>${guava.version}</version>
           </dependency>
         </dependencies>
       </dependencyManagement>