From ecc0becad10b96ef1007c31c1ad613a1496175b0 Mon Sep 17 00:00:00 2001
From: Akanksha Kedia <akedia@visa.com>
Date: Wed, 9 Sep 2026 17:45:51 +0530
Subject: [PATCH 1/2] HIVE-30027: Upgrade avro from 1.12.0 to 1.12.2

Avro 1.12.2 fixes a CVE by rejecting unrestricted deserialization of
arbitrary classes as SpecificRecord unless explicitly trusted via
org.apache.avro.SERIALIZABLE_CLASSES/SERIALIZABLE_PACKAGES.

AvroBytesConverterTest's SpecificDatumWriter/Reader usage now needs its
fixture class trusted explicitly; this is declared as a JVM system
property via kafka-handler/pom.xml's maven-surefire-plugin
systemPropertyVariables so it's present from fork startup.
---
 kafka-handler/pom.xml | 14 ++++++++++++++
 pom.xml               |  2 +-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/kafka-handler/pom.xml b/kafka-handler/pom.xml
index 0a4527b6773d..dc759aa0d14d 100644
--- a/kafka-handler/pom.xml
+++ b/kafka-handler/pom.xml
@@ -227,6 +227,20 @@
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-jar-plugin</artifactId>
       </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-surefire-plugin</artifactId>
+        <configuration>
+          <!-- Avro's ClassSecurityValidator reads the trusted-classes allowlist once when it is
+               first loaded, so it must be present as a JVM system property from fork startup;
+               setting it at test runtime (e.g. in @BeforeClass) is too late. Scoped to this
+               module's own SimpleRecord test fixture (used by AvroBytesConverterTest), not a
+               repo-wide trust grant. -->
+          <systemPropertyVariables>
+            <org.apache.avro.SERIALIZABLE_CLASSES>org.apache.hadoop.hive.kafka.SimpleRecord</org.apache.avro.SERIALIZABLE_CLASSES>
+          </systemPropertyVariables>
+        </configuration>
+      </plugin>
     </plugins>
     <pluginManagement>
       <plugins>
diff --git a/pom.xml b/pom.xml
index 657b149fbe94..a5bbfe4e544a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -114,7 +114,7 @@
     <!-- Make sure to sync it with standalone-metastore/pom.xml -->
     <antlr4.version>4.9.3</antlr4.version>
     <apache-directory-server.version>2.0.0-M24</apache-directory-server.version>
-    <avro.version>1.12.0</avro.version>
+    <avro.version>1.12.2</avro.version>
     <awaitility.version>4.2.1</awaitility.version>
     <azure-storage-file-datalake.version>12.22.0</azure-storage-file-datalake.version>
     <bcprov-jdk18on.version>1.84</bcprov-jdk18on.version>

From b4e0b7b83fc060a9f677436cb86389c27e10ac44 Mon Sep 17 00:00:00 2001
From: Akanksha Kedia <akedia@visa.com>
Date: Fri, 11 Sep 2026 17:33:42 +0530
Subject: [PATCH 2/2] HIVE-30027: Trust Wikipedia SpecificRecord fixture in
 itests/qtest kafka driver

TestMiniHiveKafkaCliDriver (kafka_storage_handler.q) produces its test
data via QTestMiniClusters#getAvroRows(), which builds a
SpecificDatumWriter from Wikipedia's schema. Avro 1.12.x's
ClassSecurityValidator forbids that class resolution unless explicitly
trusted, same as the kafka-handler unit test fix in this PR. Declared
via maven-surefire-plugin systemPropertyVariables so it's present from
JVM fork startup, not via @BeforeClass (already shown unreliable for
this exact failure mode earlier in this PR).
---
 itests/qtest/pom.xml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/itests/qtest/pom.xml b/itests/qtest/pom.xml
index dbb16c7b02e9..aeedbc67b19d 100644
--- a/itests/qtest/pom.xml
+++ b/itests/qtest/pom.xml
@@ -613,6 +613,14 @@
             <additionalClasspathElement>${test.conf.dir}</additionalClasspathElement>
             <additionalClasspathElement>${basedir}/${hive.path.to.root}/conf</additionalClasspathElement>
           </additionalClasspathElements>
+          <!-- MiniKafkaCliConfig (kafka_storage_handler.q) produces test data via
+               QTestMiniClusters#getAvroRows(), which resolves the generated
+               org.apache.hive.kafka.Wikipedia SpecificRecord fixture. Avro's
+               ClassSecurityValidator (introduced in 1.12.x) forbids that resolution
+               unless the class is explicitly trusted. -->
+          <systemPropertyVariables>
+            <org.apache.avro.SERIALIZABLE_CLASSES>org.apache.hive.kafka.Wikipedia</org.apache.avro.SERIALIZABLE_CLASSES>
+          </systemPropertyVariables>
         </configuration>
       </plugin>
     </plugins>