-
Notifications
You must be signed in to change notification settings - Fork 5.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes to make clone method final to increase security #23916
Conversation
|
2603304
to
be2b280
Compare
Nit suggestion for the release note entry to follow the Order of changes in the Release Notes Guidelines. Please edit this suggestion as needed to more accurately describe this PR.
(note: edited, then realized this had already been responded to. Un-edited to restore comment to original state.) |
ba3141f
to
49e5f0b
Compare
Thanks for the release note entry! Nit ! missed earlier, please remove the space between
|
@steveburnett Corrected the message. Please check |
@bibith4 - LGTM, thanks! |
Does this fix a specific CVE? If not, let's not add this to the release notes--too granular. |
@tdcmeehan This change isn't meant to address a specific CVE but to resolve a static scan issue. I have removed the release note from the PR. Please check |
Description
Improve Cloneable interface by making clone method final to increase security
Made the changes in
presto-main/src/main/java/com/facebook/presto/operator/aggregation/differentialentropy/WeightedDoubleReservoirSample.java:110
presto-main/src/main/java/com/facebook/presto/operator/aggregation/differentialentropy/UnweightedDoubleReservoirSample.java:124
Motivation and Context
All classes implementing the Cloneable interface must have a final clone() method. A class with a clone() method that is not declared final allows an object to be created without calling the constructor. This can cause the object to be in an unexpected state.
Impact
no impact
Test Plan
Verified existing Unit test case for above fix :
(1) presto-main/src/test/java/com/facebook/presto/operator/aggregation/differentialentropy/TestWeightedDoubleReservoirSample.java
(2) presto-main/src/test/java/com/facebook/presto/operator/aggregation/differentialentropy/TestUnweightedDoubleReservoirSample.java
Release Notes
Please follow release notes guidelines and fill in the release notes below.
== NO RELEASE NOTE ==