scalacenter/bloop

Using SBT version which has log4j vulnerability fixed

vikasdp opened this issue · 13 comments

vikasdp commented

couldn't find bloop version that uses SBT version which has log4j vulnerability fixed in it. is there going to be a new bloop version available which addresses this?

tgodzik commented

Thanks for reporting! The bloop plugin can be used with the later versions of SBT. We haven't managed to update Bloop repo itself to 1.6.0 due to some incompatibilities. This should not cause any issues however, since we do not accept any user input or run jobs in prs from unknown contributors .

Please correct me if I am wrong.

vikasdp commented

thanks @tgodzik for the response. may be I missed something but through Metals Metals we using bloop - do you know where/how we can configure bloop (again we use bloop only via metals plugin) use later version of SBT (which has log4j vulnerability fixed) ?

tgodzik commented

Bloop itself doesn't use sbt. The bloop plugin is only used to export configuration files that can later be used to compile the project.

scottweaver commented

So is this a Bloop issue or the Metals plugin issue that is responsible for introducing the vulnerable version of log4j (2.8.1)?

This breaks Metals entirely for me as I am behind an Artifactory proxy repo that disallows vulnerable versions of Log4j to be downloaded.

tgodzik commented

This is a Bloop issue, could you try setting Bloop 1.4.13? The log4j version should be updated in #1667

vikasdp commented

where is the configuration in metals to change bloop version? do you need to download bloop separately to use a diff bloop version from metals than the one metals uses by default?

vikasdp commented

thanks @scottweaver - unfortunately no SNAPSHOT versions are allowed to download behind company proxy. so pre-release version isn't an option for us.

scottweaver commented

The other work around is to switch to using SBT instead of Bloop in Metals.
> Metals: Switch build server and select SBT.

tgodzik commented

We will also be doing a new release next week, so this should be available by default.

  • 👍2
  • ❤️1
tgodzik commented

Bloop now uses sbt 1.6.2 with fixed log4j vulnerability.

vikasdp commented

@tgodzik - will there be a release version available soon with all the fixes here? https://github.com/scalameta/metals-vscode/releases - can see 1.12.28 is a pre-release version. where I am(behind corporate proxies) no pre-release versions are available/allowed to install.

tgodzik commented

I will try to release next week.

  • 👍1