Fix the security vulnerability from jackcon databind

[beinan]

What changes are proposed in this pull request?

fix https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36518

Why are the changes needed?

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

Does this PR introduce any user facing changes?

no

[Xenorith]

this unit test failure looks real:
Java 8 Integration Tests / modules: (alluxio.client.**,!alluxio.client.fs.**,!alluxio.client.cli.**,!alluxio.client.fuse.**) (pull_request) Failing after 13m — modules: (alluxio.client.**,!alluxio.client.fs.**,!alluxio.client.cli.**,!alluxio.client.fuse.**)
https://github.com/Alluxio/alluxio/runs/6734201778?check_suite_focus=true

[beinan]

this unit test failure looks real: Java 8 Integration Tests / modules: (alluxio.client.**,!alluxio.client.fs.**,!alluxio.client.cli.**,!alluxio.client.fuse.**) (pull_request) Failing after 13m — modules: (alluxio.client.**,!alluxio.client.fs.**,!alluxio.client.cli.**,!alluxio.client.fuse.**) https://github.com/Alluxio/alluxio/runs/6734201778?check_suite_focus=true

Yes, looks like the behavior of null/empty values changed, from '' to 'null' . I will try to fix it soon.

S3ClientRestApiTest.completeMultipartUpload:1172 expected:<CompleteMultipartUploadResult{mLocation='/bucket/object', mBucket='bucket', mKey='object', mETag='"2376cabb1349637a7e68b8a8c1db2485"', mCode='', mMessage=''}> but was:<CompleteMultipartUploadResult{mLocation='/bucket/object', mBucket='bucket', mKey='object', mETag='"2376cabb1349637a7e68b8a8c1db2485"', mCode='null', mMessage='null'}>

[beinan]

I fix the test by adding @JsonInclude(JsonInclude.Include.NON_EMPTY) to the CompleteMultipartUploadResult, because the behavior of the null/empty value handling got changed from jackson 2.12. FasterXML/jackson-dataformat-xml#411 so I just exclude null and empty values during the serialization .

So the result is changed from

 <CompleteMultipartUploadResult><Location>/bucket/object</Location><Bucket>bucket</Bucket><Key>object</Key><ETag>"53a35d042386eecf1ba819c7668a11a5"</ETag><Code/><Message/></CompleteMultipartUploadResult>

to

<CompleteMultipartUploadResult><Location>/bucket/object</Location><Bucket>bucket</Bucket><Key>object</Key><ETag>"53a35d042386eecf1ba819c7668a11a5"</ETag></CompleteMultipartUploadResult>

The <Code/> and <Message/> are excluded when the values are null or empty.

@ZhuTopher could you help take a look? thanks!

[ZhuTopher]

None of the available fields for CompleteMultipartUpload seem be fields which are intended to be empty strings, so I'm okay with this.

[ZhuTopher]

In fact <Code/> and <Message/> belong to error responses and not CompleteMultipartUpload directly. Again, change should be fine.

[beinan]

Thank you @ZhuTopher ! If you saw any abnormal ser/deser results of json or xml, just let me know, thx!

[beinan]

alluxio-bot, merge this please.