Fix/security validate profile image url

build.gradle

@@ -72,7 +72,8 @@ buildscript {
   ext.openLineageVersion = '1.33.0'
   ext.awsSdk2Version = '2.30.33'
   ext.micrometerVersion = '1.16.4'
-  ext.vertxVersion = '4.5.24'  // CVE-2026-1002 (e.g. from fabric8 kubernetes-httpclient-vertx)
+  // CVE-2026-1002; CVE-2026-6860 / GHSA-3g76-f9xq-8vp6 (SNI cache growth); fabric8 kubernetes-httpclient-vertx
+  ext.vertxVersion = '4.5.27'
   // CVE-2026-41417 (netty-codec-http): 4.1.133+ or 4.2.13+; CVE-2026-42577 (netty-transport-native-epoll): 4.2.13+
   ext.nettyVersion = '4.2.13.Final' // align all io.netty modules (excl. netty-tcnative line)
   // CVE-2026-40542 / GHSA: SCRAM-SHA-256 authentication verification (httpclient5 5.6 → 5.6.1+)

datahub-frontend/gradle.lockfile

@@ -253,10 +253,10 @@ io.prometheus:prometheus-metrics-exposition-formats:1.4.3=runtimeClasspath,testR
 io.prometheus:prometheus-metrics-exposition-textformats:1.4.3=runtimeClasspath,testRuntimeClasspath
 io.prometheus:prometheus-metrics-model:1.4.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 io.prometheus:prometheus-metrics-tracer-common:1.4.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-io.vertx:vertx-auth-common:4.5.24=runtimeClasspath,testRuntimeClasspath
-io.vertx:vertx-core:4.5.24=runtimeClasspath,testRuntimeClasspath
-io.vertx:vertx-web-client:4.5.24=runtimeClasspath,testRuntimeClasspath
-io.vertx:vertx-web-common:4.5.24=runtimeClasspath,testRuntimeClasspath
+io.vertx:vertx-auth-common:4.5.27=runtimeClasspath,testRuntimeClasspath
+io.vertx:vertx-core:4.5.27=runtimeClasspath,testRuntimeClasspath
+io.vertx:vertx-web-client:4.5.27=runtimeClasspath,testRuntimeClasspath
+io.vertx:vertx-web-common:4.5.27=runtimeClasspath,testRuntimeClasspath
 jakarta.annotation:jakarta.annotation-api:3.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 jakarta.inject:jakarta.inject-api:2.0.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 jakarta.json:jakarta.json-api:2.1.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath

datahub-graphql-core/gradle.lockfile

@@ -249,10 +249,10 @@ io.prometheus:prometheus-metrics-tracer-common:1.4.3=compileClasspath,runtimeCla
 io.swagger.core.v3:swagger-annotations:2.2.30=runtimeClasspath,testRuntimeClasspath
 io.vavr:vavr-match:0.10.2=runtimeClasspath,testRuntimeClasspath
 io.vavr:vavr:0.10.2=runtimeClasspath,testRuntimeClasspath
-io.vertx:vertx-auth-common:4.5.24=runtimeClasspath,testRuntimeClasspath
-io.vertx:vertx-core:4.5.24=runtimeClasspath,testRuntimeClasspath
-io.vertx:vertx-web-client:4.5.24=runtimeClasspath,testRuntimeClasspath
-io.vertx:vertx-web-common:4.5.24=runtimeClasspath,testRuntimeClasspath
+io.vertx:vertx-auth-common:4.5.27=runtimeClasspath,testRuntimeClasspath
+io.vertx:vertx-core:4.5.27=runtimeClasspath,testRuntimeClasspath
+io.vertx:vertx-web-client:4.5.27=runtimeClasspath,testRuntimeClasspath
+io.vertx:vertx-web-common:4.5.27=runtimeClasspath,testRuntimeClasspath
 jakarta.activation:jakarta.activation-api:2.1.2=runtimeClasspath,testRuntimeClasspath
 jakarta.annotation:jakarta.annotation-api:3.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 jakarta.json:jakarta.json-api:2.1.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath

datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/resolvers/ResolverUtils.java

@@ -188,12 +188,7 @@ public static Criterion criterionFromFilter(final FacetFilterInput filter) {
       condition = Condition.EQUAL;
     }
 
-    final List<String> values;
-    if (filter.getValues() == null && filter.getValue() != null) {
-      values = Collections.singletonList(filter.getValue());
-    } else {
-      values = filter.getValues();
-    }
+    final List<String> values = filter.getValues();
 
     return buildCriterion(filter.getField(), condition, filter.getNegated(), values);
   }

datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/resolvers/auth/ListServiceAccountsResolver.java

@@ -71,7 +71,6 @@ public CompletableFuture<ListServiceAccountsResult> get(DataFetchingEnvironment
                 ImmutableList.of(
                     new FacetFilterInput(
                         SUB_TYPES_FIELD,
-                        null,
                         ImmutableList.of(ServiceAccountUtils.SERVICE_ACCOUNT_SUB_TYPE),
                         false,
                         FilterOperator.EQUAL));

datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/resolvers/dataproduct/ListDataProductAssetsResolver.java

@@ -225,8 +225,9 @@ public CompletableFuture<SearchResults> get(DataFetchingEnvironment environment)
    * filter determine which urns we filter search results on. Otherwise, if no output port filter is
    * found, return all asset urns as per usual.
    */
+  // Package-private for unit tests.
   @Nonnull
-  private List<Urn> getUrnsToFilterOn(
+  List<Urn> getUrnsToFilterOn(
       @Nonnull final List<Urn> assetUrns,
       @Nonnull final Set<String> outputPortUrns,
       @Nullable final List<FacetFilterInput> filters) {
@@ -240,7 +241,10 @@ private List<Urn> getUrnsToFilterOn(
     // optionally get entities that explicitly are or are not output ports
     List<Urn> urnsToFilterOn = assetUrns;
     if (isOutputPort.isPresent()) {
-      if (isOutputPort.get().getValue().equals("true")) {
+      List<String> outputPortVals = isOutputPort.get().getValues();
+      if (outputPortVals != null
+          && !outputPortVals.isEmpty()
+          && "true".equals(outputPortVals.get(0))) {
         urnsToFilterOn = outputPortUrns.stream().map(UrnUtils::getUrn).collect(Collectors.toList());
       } else {
         urnsToFilterOn =

datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/resolvers/ingest/execution/GetLatestSuccessfulExecutionRequestResolver.java

@@ -88,13 +88,11 @@ private Urn getLatestSuccessfulExecutionRequestUrn(
                     List.of(
                         new FacetFilterInput(
                             INGESTION_SOURCE_FIELD,
-                            null,
                             List.of(ingestionSourceUrn),
                             false,
                             FilterOperator.EQUAL),
                         new FacetFilterInput(
                             RESULT_STATUS_FIELD,
-                            null,
                             List.of(STATUS_SUCCESS),
                             false,
                             FilterOperator.EQUAL)),

datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/resolvers/ingest/execution/ListExecutionRequestsResolver.java

@@ -138,7 +138,6 @@ private void addAccessibleIngestionSourceFilter(
     filters.add(
         new FacetFilterInput(
             EXECUTION_REQUEST_INGESTION_SOURCE_FIELD,
-            null,
             sourceUrns.stream().map(Urn::toString).toList(),
             false,
             FilterOperator.EQUAL));
@@ -151,7 +150,6 @@ private List<Urn> getUrnsOfIngestionSources(
             ? List.of(
                 new FacetFilterInput(
                     INGESTION_SOURCE_SOURCE_TYPE_FIELD,
-                    null,
                     ImmutableList.of(INGESTION_SOURCE_SOURCE_TYPE_SYSTEM),
                     !systemSources,
                     FilterOperator.EQUAL))

datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/resolvers/post/ListPostsResolver.java

@@ -114,11 +114,7 @@ private Filter buildFilters(@Nullable String maybeResourceUrn, List<AndFilterInp
           new AndFilterInput(
               List.of(
                   new FacetFilterInput(
-                      "target",
-                      null,
-                      ImmutableList.of(maybeResourceUrn),
-                      false,
-                      FilterOperator.EQUAL))));
+                      "target", ImmutableList.of(maybeResourceUrn), false, FilterOperator.EQUAL))));
     }
 
     return ResolverUtils.buildFilter(null, filters);

datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/resolvers/query/ListQueriesResolver.java

@@ -134,7 +134,6 @@ private Filter buildFilters(@Nonnull final ListQueriesInput input) {
       andConditions.add(
           new FacetFilterInput(
               QUERY_SOURCE_FIELD,
-              null,
               ImmutableList.of(input.getSource().toString()),
               false,
               FilterOperator.EQUAL));
@@ -145,7 +144,6 @@ private Filter buildFilters(@Nonnull final ListQueriesInput input) {
       andConditions.add(
           new FacetFilterInput(
               QUERY_ENTITIES_FIELD,
-              null,
               ImmutableList.of(input.getDatasetUrn()),
               false,
               FilterOperator.EQUAL));

datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/resolvers/user/ListUsersResolver.java

@@ -62,7 +62,6 @@ public CompletableFuture<ListUsersResult> get(final DataFetchingEnvironment envi
                 ImmutableList.of(
                     new FacetFilterInput(
                         SUB_TYPES_FIELD,
-                        null,
                         ImmutableList.of(SERVICE_ACCOUNT_SUB_TYPE),
                         true, // negated = true to exclude service accounts
                         FilterOperator.EQUAL));

datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/resolvers/user/SearchUsersResolver.java

@@ -83,7 +83,6 @@ public CompletableFuture<SearchResults> get(DataFetchingEnvironment environment)
               ImmutableList.of(
                   new FacetFilterInput(
                       SUB_TYPES_FIELD,
-                      null,
                       ImmutableList.of(SERVICE_ACCOUNT_SUB_TYPE),
                       true, // negated = true to exclude service accounts
                       FilterOperator.EQUAL));

datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/resolvers/view/ListGlobalViewsResolver.java

@@ -113,7 +113,6 @@ private Filter buildFilters() {
     andConditions.add(
         new FacetFilterInput(
             VIEW_TYPE_FIELD,
-            null,
             ImmutableList.of(DataHubViewType.GLOBAL.name()),
             false,
             FilterOperator.EQUAL));

datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/resolvers/view/ListMyViewsResolver.java

@@ -123,11 +123,11 @@ private Filter buildFilters(
     final List<FacetFilterInput> andConditions = new ArrayList<>();
     andConditions.add(
         new FacetFilterInput(
-            CREATOR_URN_FIELD, null, ImmutableList.of(creatorUrn), false, FilterOperator.EQUAL));
+            CREATOR_URN_FIELD, ImmutableList.of(creatorUrn), false, FilterOperator.EQUAL));
     if (viewType != null) {
       andConditions.add(
           new FacetFilterInput(
-              VIEW_TYPE_FIELD, null, ImmutableList.of(viewType), false, FilterOperator.EQUAL));
+              VIEW_TYPE_FIELD, ImmutableList.of(viewType), false, FilterOperator.EQUAL));
     }
     filterCriteria.setAnd(andConditions);
 

datahub-graphql-core/src/main/resources/search.graphql

@@ -528,12 +528,6 @@ input FacetFilterInput {
   """
   field: String!
 
-  """
-  Value of the field to filter by. Deprecated in favor of `values`, which should accept a single element array for a
-  value
-  """
-  value: String @deprecated(reason: "Prefer `values` for single elements")
-
   """
   Values, one of which the intended field should match.
   """

datahub-graphql-core/src/test/java/com/linkedin/datahub/graphql/resolvers/ResolverUtilsTest.java

@@ -55,7 +55,6 @@ public void testCriterionFromFilter() throws Exception {
         criterionFromFilter(
             new FacetFilterInput(
                 "tags",
-                null,
                 ImmutableList.of("urn:li:tag:abc", "urn:li:tag:def"),
                 false,
                 FilterOperator.EQUAL));
@@ -64,16 +63,16 @@ public void testCriterionFromFilter() throws Exception {
         buildCriterion(
             "tags", Condition.EQUAL, ImmutableList.of("urn:li:tag:abc", "urn:li:tag:def")));
 
-    // this is the legacy pathway
-    Criterion valueCriterion =
+    Criterion singleValueCriterion =
         criterionFromFilter(
-            new FacetFilterInput("tags", "urn:li:tag:abc", null, true, FilterOperator.EQUAL));
-    assertEquals(valueCriterion, buildCriterion("tags", Condition.EQUAL, true, "urn:li:tag:abc"));
+            new FacetFilterInput(
+                "tags", ImmutableList.of("urn:li:tag:abc"), true, FilterOperator.EQUAL));
+    assertEquals(
+        singleValueCriterion, buildCriterion("tags", Condition.EQUAL, true, "urn:li:tag:abc"));
 
-    // check that both being null doesn't cause a NPE. this should never happen except via API
-    // interaction
+    // check that null values doesn't cause a NPE
     Criterion doubleNullCriterion =
-        criterionFromFilter(new FacetFilterInput("tags", null, null, true, FilterOperator.EQUAL));
+        criterionFromFilter(new FacetFilterInput("tags", null, true, FilterOperator.EQUAL));
     assertEquals(
         doubleNullCriterion, buildCriterion("tags", Condition.EQUAL, true, ImmutableList.of()));
   }
@@ -246,7 +245,7 @@ public void testBuildFacetFilters_valid() {
     List<FacetFilterInput> inputs =
         ImmutableList.of(
             new FacetFilterInput(
-                "field.keyword", "v1", ImmutableList.of("v1"), false, FilterOperator.EQUAL));
+                "field.keyword", ImmutableList.of("v1"), false, FilterOperator.EQUAL));
     Map<String, String> result = buildFacetFilters(inputs, Set.of("field.keyword"));
     assertEquals(result.get("field.keyword"), "v1");
   }
@@ -255,8 +254,7 @@ public void testBuildFacetFilters_valid() {
   public void testBuildFacetFilters_invalidField() {
     List<FacetFilterInput> inputs =
         ImmutableList.of(
-            new FacetFilterInput(
-                "invalid", "v1", ImmutableList.of("v1"), false, FilterOperator.EQUAL));
+            new FacetFilterInput("invalid", ImmutableList.of("v1"), false, FilterOperator.EQUAL));
     buildFacetFilters(inputs, Set.of("field.keyword"));
   }
 
@@ -276,7 +274,7 @@ public void testBuildFilter_orFilters() {
   @Test
   public void testBuildFilter_andFiltersOnly() {
     FacetFilterInput and =
-        new FacetFilterInput("f.keyword", "v", ImmutableList.of("v"), false, FilterOperator.EQUAL);
+        new FacetFilterInput("f.keyword", ImmutableList.of("v"), false, FilterOperator.EQUAL);
     Filter f = buildFilter(ImmutableList.of(and), null);
     assertNotNull(f);
     assertNotNull(f.getOr());

datahub-graphql-core/src/test/java/com/linkedin/datahub/graphql/resolvers/dataproduct/ListDataProductAssetsResolverTest.java

@@ -0,0 +1,111 @@
+package com.linkedin.datahub.graphql.resolvers.dataproduct;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertTrue;
+
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableSet;
+import com.linkedin.common.urn.Urn;
+import com.linkedin.datahub.graphql.generated.FacetFilterInput;
+import com.linkedin.entity.client.EntityClient;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import org.mockito.Mockito;
+import org.testng.annotations.Test;
+
+public class ListDataProductAssetsResolverTest {
+
+  private static final Urn ASSET_A = Urn.createFromTuple("dataset", "urn-a");
+  private static final Urn ASSET_B = Urn.createFromTuple("dataset", "urn-b");
+
+  @Test
+  public void testGetUrnsToFilterOn_noFilters_returnsAllAssets() {
+    ListDataProductAssetsResolver resolver =
+        new ListDataProductAssetsResolver(Mockito.mock(EntityClient.class));
+
+    List<Urn> result =
+        resolver.getUrnsToFilterOn(
+            ImmutableList.of(ASSET_A, ASSET_B), ImmutableSet.of(ASSET_A.toString()), null);
+
+    assertEquals(result.size(), 2);
+    assertTrue(result.contains(ASSET_A));
+    assertTrue(result.contains(ASSET_B));
+  }
+
+  @Test
+  public void testGetUrnsToFilterOn_outputPortTrue_filtersToOutputPortUrnsOnly() {
+    ListDataProductAssetsResolver resolver =
+        new ListDataProductAssetsResolver(Mockito.mock(EntityClient.class));
+
+    FacetFilterInput filter = new FacetFilterInput();
+    filter.setField("isOutputPort");
+    filter.setValues(ImmutableList.of("true"));
+
+    List<Urn> result =
+        resolver.getUrnsToFilterOn(
+            ImmutableList.of(ASSET_A, ASSET_B),
+            ImmutableSet.of(ASSET_A.toString()),
+            new ArrayList<>(Collections.singletonList(filter)));
+
+    assertEquals(result.size(), 1);
+    assertEquals(result.get(0), ASSET_A);
+  }
+
+  @Test
+  public void testGetUrnsToFilterOn_outputPortFalse_excludesOutputPorts() {
+    ListDataProductAssetsResolver resolver =
+        new ListDataProductAssetsResolver(Mockito.mock(EntityClient.class));
+
+    FacetFilterInput filter = new FacetFilterInput();
+    filter.setField("isOutputPort");
+    filter.setValues(ImmutableList.of("false"));
+
+    List<Urn> result =
+        resolver.getUrnsToFilterOn(
+            ImmutableList.of(ASSET_A, ASSET_B),
+            ImmutableSet.of(ASSET_A.toString()),
+            new ArrayList<>(Collections.singletonList(filter)));
+
+    assertEquals(result.size(), 1);
+    assertEquals(result.get(0), ASSET_B);
+  }
+
+  @Test
+  public void testGetUrnsToFilterOn_outputPortEmptyValues_excludesOutputPorts() {
+    ListDataProductAssetsResolver resolver =
+        new ListDataProductAssetsResolver(Mockito.mock(EntityClient.class));
+
+    FacetFilterInput filter = new FacetFilterInput();
+    filter.setField("isOutputPort");
+    filter.setValues(ImmutableList.of());
+
+    List<Urn> result =
+        resolver.getUrnsToFilterOn(
+            ImmutableList.of(ASSET_A, ASSET_B),
+            ImmutableSet.of(ASSET_A.toString()),
+            new ArrayList<>(Collections.singletonList(filter)));
+
+    assertEquals(result.size(), 1);
+    assertEquals(result.get(0), ASSET_B);
+  }
+
+  @Test
+  public void testGetUrnsToFilterOn_outputPortNullValues_excludesOutputPorts() {
+    ListDataProductAssetsResolver resolver =
+        new ListDataProductAssetsResolver(Mockito.mock(EntityClient.class));
+
+    FacetFilterInput filter = new FacetFilterInput();
+    filter.setField("isOutputPort");
+    filter.setValues(null);
+
+    List<Urn> result =
+        resolver.getUrnsToFilterOn(
+            ImmutableList.of(ASSET_A, ASSET_B),
+            ImmutableSet.of(ASSET_A.toString()),
+            new ArrayList<>(Collections.singletonList(filter)));
+
+    assertEquals(result.size(), 1);
+    assertEquals(result.get(0), ASSET_B);
+  }
+}

datahub-graphql-core/src/test/java/com/linkedin/datahub/graphql/resolvers/ingest/execution/GetLatestSuccessfulExecutionRequestResolverTest.java

@@ -124,13 +124,11 @@ private EntityClient getMockedEntityClient(SearchResult filterSearchResult) thro
                             List.of(
                                 new FacetFilterInput(
                                     "ingestionSource",
-                                    null,
                                     List.of(TEST_INGESTION_SOURCE_URN),
                                     false,
                                     FilterOperator.EQUAL),
                                 new FacetFilterInput(
                                     "executionResultStatus",
-                                    null,
                                     List.of("SUCCESS"),
                                     false,
                                     FilterOperator.EQUAL)),