From 969fb00269d850aeb41a11e5fff9519444e13d60 Mon Sep 17 00:00:00 2001
From: Mariam Almesfer <mariamalmesfer22@gmail.com>
Date: Tue, 7 Oct 2025 14:33:07 +0300
Subject: [PATCH] Fix CVE-2025-48924: Remove commons-lang from presto-pinot

---
 pom.xml                                                     | 5 +++++
 presto-accumulo/pom.xml                                     | 6 ------
 .../java/com/facebook/presto/accumulo/index/Indexer.java    | 2 +-
 .../facebook/presto/accumulo/io/AccumuloRecordCursor.java   | 2 +-
 .../main/java/com/facebook/presto/accumulo/model/Row.java   | 2 +-
 5 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/pom.xml b/pom.xml
index 045a68efee7f1..911e2d3c0666e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -2719,6 +2719,11 @@
                     </exclusion>
                 </exclusions>
             </dependency>
+            <dependency>
+                <groupId>net.hydromatic</groupId>
+                <artifactId>aggdesigner-algorithm</artifactId>
+                <version>6.1</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 
diff --git a/presto-accumulo/pom.xml b/presto-accumulo/pom.xml
index 0b21198df50bf..882bd665d6da1 100644
--- a/presto-accumulo/pom.xml
+++ b/presto-accumulo/pom.xml
@@ -232,12 +232,6 @@
             <artifactId>guice</artifactId>
         </dependency>
 
-        <dependency>
-            <groupId>commons-lang</groupId>
-            <artifactId>commons-lang</artifactId>
-            <version>2.6</version>
-        </dependency>
-
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
diff --git a/presto-accumulo/src/main/java/com/facebook/presto/accumulo/index/Indexer.java b/presto-accumulo/src/main/java/com/facebook/presto/accumulo/index/Indexer.java
index 9ff5a6216cac4..3d3e0215fd35e 100644
--- a/presto-accumulo/src/main/java/com/facebook/presto/accumulo/index/Indexer.java
+++ b/presto-accumulo/src/main/java/com/facebook/presto/accumulo/index/Indexer.java
@@ -46,7 +46,7 @@
 import org.apache.accumulo.core.iterators.user.SummingCombiner;
 import org.apache.accumulo.core.security.Authorizations;
 import org.apache.accumulo.core.security.ColumnVisibility;
-import org.apache.commons.lang.ArrayUtils;
+import org.apache.commons.lang3.ArrayUtils;
 import org.apache.commons.lang3.tuple.Pair;
 import org.apache.hadoop.io.Text;
 
diff --git a/presto-accumulo/src/main/java/com/facebook/presto/accumulo/io/AccumuloRecordCursor.java b/presto-accumulo/src/main/java/com/facebook/presto/accumulo/io/AccumuloRecordCursor.java
index 39fbf440dc975..4ca2e9a250ea1 100644
--- a/presto-accumulo/src/main/java/com/facebook/presto/accumulo/io/AccumuloRecordCursor.java
+++ b/presto-accumulo/src/main/java/com/facebook/presto/accumulo/io/AccumuloRecordCursor.java
@@ -30,7 +30,7 @@
 import org.apache.accumulo.core.data.Value;
 import org.apache.accumulo.core.iterators.FirstEntryInRowIterator;
 import org.apache.accumulo.core.iterators.user.WholeRowIterator;
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.apache.hadoop.io.Text;
 
 import java.io.IOException;
diff --git a/presto-accumulo/src/main/java/com/facebook/presto/accumulo/model/Row.java b/presto-accumulo/src/main/java/com/facebook/presto/accumulo/model/Row.java
index 893ba72b64526..bcec391eb259b 100644
--- a/presto-accumulo/src/main/java/com/facebook/presto/accumulo/model/Row.java
+++ b/presto-accumulo/src/main/java/com/facebook/presto/accumulo/model/Row.java
@@ -21,7 +21,7 @@
 import com.google.common.base.Splitter;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 
 import java.sql.Date;
 import java.sql.Time;