https://github.com/baidu/brcc/blob/7785480fd3b90e62198c237623cec47d6dfab2e8/brcc-sdk/pom.xml#L32-L37

CVE-2020-5398 CVE-2020-5421

Recommended upgrade version：5.1.18.RELEASE

https://github.com/baidu/brcc/blob/7785480fd3b90e62198c237623cec47d6dfab2e8/brcc-sdk-starter/pom.xml#L27-L38

CVE-2020-5421

Recommended upgrade version：2.1.17.RELEASE

org.springframework.data.redis.RedisConnectionFailureException: Unable to connect to Redis; nested exception is io.lettuce.core.RedisConnectionException: Unable to connect to x.x.x.x:x at org.springframework.data.redis.connection.lettuce.LettuceConnectionFactory$ExceptionTranslatingConnectionProvider.translateException(LettuceConnectionFactory.java:1553) ~[spring-data-redis-2.4.1.jar:2.4.1] .... Caused by: io.lettuce.core.RedisCommandExecutionException: ERR Client sent AUTH, but no password is set at io.lettuce.core.internal.ExceptionFactory.createExecutionException(ExceptionFactory.java:137) ~[lettuce-core-6.0.1.RELEASE.jar:6.0.1.RELEASE] at io.lettuce.core.internal.ExceptionFactory.createExecutionException(ExceptionFactory.java:110) ~[lettuce-core-6.0.1.RELEASE.jar:6.0.1.RELEASE] at io.lettuce.core.protocol.AsyncCommand.completeResult(AsyncCommand.java:120) ~[lettuce-core-6.0.1.RELEASE.jar:6.0.1.RELEASE]

现象： 引入mybatis-spring-boot-starter 2.1.3 （对应mybatis-spring 2.0.5）后， 在多数据源情况下sdk多次加载brcc配置。 问题分析： 项目中多数据源情况下， 通过@MapperScan指定扫描不同的package和sqlSessionFactory, @MapperScan -> @Import(MapperScannerRegistrar.class) -> MapperScannerConfigurer MapperScannerConfigurer 实现了BeanDefinitionRegistryPostProcessor接口， 在配置processPropertyPlaceHolders为true的情况下会调用processPropertyPlaceHolders()方法 ` private void processPropertyPlaceHolders() { // 获取到brcc的ConfigCenterPropertyPlaceholderConfigurer Map<String, PropertyResourceConfigurer> prcs = applicationContext.getBeansOfType(PropertyResourceConfigurer.class, false, false);

if (!prcs.isEmpty() && applicationContext instanceof ConfigurableApplicationContext) {
  BeanDefinition mapperScannerBean = ((ConfigurableApplicationContext) applicationContext).getBeanFactory()
      .getBeanDefinition(beanName);

  // PropertyResourceConfigurer does not expose any methods to explicitly perform
  // property placeholder substitution. Instead, create a BeanFactory that just
  // contains this mapper scanner and post process the factory.
  DefaultListableBeanFactory factory = new DefaultListableBeanFactory();
  factory.registerBeanDefinition(beanName, mapperScannerBean);

  for (PropertyResourceConfigurer prc : prcs.values()) {
    // 主动调用brcc替换mapperScannerBean中的属性
    prc.postProcessBeanFactory(factory);
  }

  PropertyValues values = mapperScannerBean.getPropertyValues();

  this.basePackage = updatePropertyValue("basePackage", values);
  this.sqlSessionFactoryBeanName = updatePropertyValue("sqlSessionFactoryBeanName", values);
  this.sqlSessionTemplateBeanName = updatePropertyValue("sqlSessionTemplateBeanName", values);
  this.lazyInitialization = updatePropertyValue("lazyInitialization", values);
}
this.basePackage = Optional.ofNullable(this.basePackage).map(getEnvironment()::resolvePlaceholders).orElse(null);
this.sqlSessionFactoryBeanName = Optional.ofNullable(this.sqlSessionFactoryBeanName)
    .map(getEnvironment()::resolvePlaceholders).orElse(null);
this.sqlSessionTemplateBeanName = Optional.ofNullable(this.sqlSessionTemplateBeanName)
    .map(getEnvironment()::resolvePlaceholders).orElse(null);
this.lazyInitialization = Optional.ofNullable(this.lazyInitialization).map(getEnvironment()::resolvePlaceholders)
    .orElse(null);

}

` 这样导致了brcc多次远程调用

统一替换为

/*
 * Copyright (c) Baidu Inc. All rights reserved.
 * 
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */