fix(security): document/suppress non-applicable jackson GHSA-5jmj-h7xm-6q6v (no 2.x fix)#308
Closed
devops-thiago wants to merge 1 commit into
Closed
fix(security): document/suppress non-applicable jackson GHSA-5jmj-h7xm-6q6v (no 2.x fix)#308devops-thiago wants to merge 1 commit into
devops-thiago wants to merge 1 commit into
Conversation
…m-6q6v OpenSSF Scorecard flags GHSA-5jmj-h7xm-6q6v (CVE-2026-54515), a jackson-databind case-insensitive bypass of per-property @JsonIgnoreProperties filtering. Verified against OSV with a CycloneDX SBOM built from Maven's own resolution (not a scanner re-parsing the pom): - Our resolved jackson-databind 2.22.0 IS in the affected set — a real match. - No fix exists for the Jackson 2.x line: the only fix is tools.jackson.core:jackson-databind 3.1.4 (Jackson 3.x, new namespace), which Quarkus 3.37 does not use. The 2.22.0 bump cannot clear it; the 0.2.1 CHANGELOG belief is stale (advisory revised to include 2.x with no 2.x fix). - Not applicable here: all @JsonIgnoreProperties usage is ignoreUnknown=true (drop unknowns for forward compat), never a per-property name blocklist, and there is no polymorphic/default typing — no protected property for the bypass to defeat. Per Scorecard's remediation guidance, add osv-scanner.toml at the repo root ignoring the advisory with a documented reason, and correct the now-inaccurate pom override comment. Verified osv-scanner filters it out with this config (exit 0). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
🤖 ThrillhouseBot PR SummaryWhat this PR doesAdds an osv-scanner.toml file to ignore GHSA-5jmj-h7xm-6q6v (CVE-2026-54515) because the Jackson vulnerability does not affect this project, which uses only ignoreUnknown = true and no per-property filtering, and updates the corresponding comment in pom.xml. Changes Overview
Changed Files
Risk Assessment
No new issues found in this PR, but the review cannot be approved until required CI is confirmed green.
|
| Check | Type | Status | Detail |
|---|---|---|---|
| format | missing | ⏳ Pending | - |
| test | missing | ⏳ Pending | - |
| frontend | missing | ⏳ Pending | - |
| trivy | missing | ⏳ Pending | - |
Automated review by ThrillhouseBot. Reply with /review to re-run.
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This was referenced Jul 1, 2026
Closed
This was referenced Jul 15, 2026
devops-thiago
added a commit
that referenced
this pull request
Jul 17, 2026
## What type of PR is this? <!-- Check all that apply --> - [ ] 🐛 Bug fix - [ ] ✨ Feature - [x] 📝 Documentation - [ ] 🔧 Refactor - [ ] 🚀 Performance - [ ] ✅ Test - [x] 🔒 Security - [ ] 📦 Dependency update - [x] 🏗️ CI/CD ## Description Closes the v0.3.1 dual-gate gap from #342: ThrillhouseBot's LLM review and static dependency CI are complementary, not substitutes. ### Changes - **CONTRIBUTING.md** — documents the dual-gate merge policy, optional Bugbot as a non-required third signal, and maintainer triage when the gates disagree (including the Jackson GHSA hold pattern from #308). - **dependency-review.yml** — runs on `main` / `develop` / `release/**` (aligned with CI), with comments tying the job to the dual-gate policy. - **Repo ruleset (already applied)** — `dependency-review` added to required status checks on `main-protection` alongside `format`, `test`, `frontend`, `trivy`. Does **not** duplicate ThrillhouseBot's LLM pass or implement linters-in-prompt (#34). ## Related Issues Fixes #342 Related: #34 (linters in LLM context — separate), #308 (Jackson GHSA hold pattern), #113, #318 ## How Has This Been Tested? - [ ] Unit tests - [ ] Integration tests - [x] Manual testing - Confirmed `main-protection` ruleset now requires `dependency-review`. - Reviewed workflow YAML against existing SHA-pinned action versions. - Docs-only / workflow-metadata change — no Java/frontend unit tests required. - CI on this PR: `dependency-review`, `format`, `test`, `frontend`, `trivy`, Sonar, CodeQL, Codecov all green. ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code - [ ] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [x] I have updated the documentation accordingly - [x] My changes generate no new warnings or errors ## Screenshots / Logs N/A — docs + workflow metadata only. Dependency Review summary on this PR: no vulnerabilities or license issues found. ## Additional Notes - ThrillhouseBot remains a soft gate (check can be NEUTRAL/skipped); static `dependency-review` is now merge-blocking. - Ruleset change is live on the repo already; merging this PR lands the docs + workflow branch-trigger alignment.
devops-thiago
added a commit
that referenced
this pull request
Jul 17, 2026
…pts (#113) (#400) ## Summary Implements the prompt eval/regression corpus from #113: prompt and verifier changes are no longer validated only by the next live PR review — confirmed dogfood outcomes are now pinned as labeled fixtures a suite can replay. - **Labeled corpus** (`src/test/resources/evalcorpus/<case>/case.json` + `diff.txt`): each case pins a real, thread-resolved dogfood outcome. Diffs are reconstructed from the exact commits the bot reviewed (`original_commit_id` of each review comment) and stored in the same `### path (status, +A -D)` + fenced-patch format the pipeline sends to the model. Seeded with: - PR #100 refuted FP — empty-line `IndexOutOfBoundsException` (`expectedVerdicts: [rejected]`) - PR #100 confirmed TP — `\ No newline at end of file` indexing (`[confirmed]`) - PR #84 refuted FP — omitted-lines off-by-one arithmetic (#96/#97) (`[rejected]`) - PR #101 refuted FP — `accountOwner` NPE with caller guard outside the diff (#106/#107) (`[rejected]`) - Two generator-side cases over the PR #100 diff: `must-find` the no-newline bug, `must-not-find` the empty-line IOOBE claim - **Deterministic guard** (`EvalCorpusTest`, runs in every CI build): validates corpus schema, provenance, verdict labels, and diff format — a malformed new case fails at merge time, no AI call. - **Opt-in live suite** (`PromptEvalTest`, JUnit tag `eval`, surefire-excluded by default): verifier cases go through the production `FindingVerificationService.verify` path and classify the outcome (dropped→rejected, lowered→downgraded, unchanged→confirmed); generator cases run `PrReviewer.reviewStream` and keyword-match findings on the target file. LLM nondeterminism is absorbed by majority-over-N sampling (`-Deval.samples`, default 3) plus a tolerated-regression budget (`-Deval.tolerated`, default 0). - **`-Peval` Maven profile** flips the surefire tag filters; CONTRIBUTING documents the workflow and how to add cases from resolved review threads. Bugbot-comparison seeds from the issue's follow-up comment (PRs #305/#307/#308/#333) could not be extracted — those PRs have no inline review data via the API — but the corpus is append-only by design: new cases are a directory drop, no code change. ## Issue Fixes #113 ## Test plan - [x] `EvalCorpusTest` (4 tests) passes and runs in the default build - [x] `./mvnw test -Peval -Dtest=PromptEvalTest` wires up (skips via assumption without a provider key; live run is opt-in by design) - [x] `./mvnw verify` passes locally — 1593 tests, Spotless, SpotBugs, JaCoCo all green - [x] No production code changed; all new files are test-scoped or fixtures
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
Description
OpenSSF Scorecard's Vulnerabilities check flags GHSA-5jmj-h7xm-6q6v (CVE-2026-54515) — a jackson-databind case-insensitive bypass of per-property
@JsonIgnorePropertiesfiltering. This PR investigates it properly and addresses it.Findings (verified against OSV via a Maven-generated CycloneDX SBOM, not a pom re-parse)
jackson-databind 2.22.0is explicitly in the advisory's affected set.tools.jackson.core:jackson-databind 3.1.4— Jackson 3.x (newtools.jacksonnamespace). Quarkus 3.37 uses Jackson 2.x (com.fasterxml.jackson.core), whose entire range — including 2.22.0 — is affected with no 2.x fix. So the earlier 2.22.0 bump can't clear it; the 0.2.1 CHANGELOG's "cleared by 2.22.0" is stale (the advisory was revised to include 2.x).@JsonIgnoreProperties({"name"})name-based filters via case-insensitive matching. Every usage here is@JsonIgnoreProperties(ignoreUnknown = true)(drop unknown fields for forward-compat), never a name blocklist, and there is no polymorphic/default typing — so there is no protected property for the bypass to defeat. (Severity note: the advisory is CVSS 5.3 Medium; Scorecard's "9" is its check sub-score out of 10, not a CVSS-9.)Change
Per Scorecard's own remediation guidance ("if the vulnerability does not affect your project… create an
osv-scanner.toml"):osv-scanner.tomlat the repo root (next topom.xml) ignoring the advisory with a full documented reason.Related Issues
Addresses the OpenSSF Scorecard Vulnerabilities finding for GHSA-5jmj-h7xm-6q6v. Supersedes the understanding recorded in the 0.2.1 CHANGELOG entry.
How Has This Been Tested?
Manual testing
Generated a CycloneDX SBOM from Maven's own resolution and scanned it with osv-scanner (same DB as Scorecard): without the config → 1 finding (exit 1); with
--config osv-scanner.toml→ "filtered out… No issues found" (exit 0).Confirmed the resolved tree is Jackson 2.22.0 across the family; confirmed all 17
@JsonIgnorePropertiesareignoreUnknown = trueand there is no@JsonTypeInfo/default typing.spotless:checkpasses.Checklist
Additional Notes
jackson-bom2.22.0 override is kept (it's still the latest Jackson 2.x — best available), only its comment is corrected. It no longer clears this advisory (nothing in 2.x does).