This is an automated email from the ASF dual-hosted git repository.
ramackri pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/master by this push:
new 38d215322 RANGER-5647: Fix date-bound tag policy engine test fixtures
(#1018)
38d215322 is described below
commit 38d21532259a9d19f9539ee358ec5b4c732f42ee
Author: Ramachandran Krishnan <[email protected]>
AuthorDate: Mon Jun 15 12:21:17 2026 +0530
RANGER-5647: Fix date-bound tag policy engine test fixtures (#1018)
* RANGER-5647: Fix date-bound tag policy engine test fixtures
RESTRICTED-FINAL deny-exception uses isAccessedBefore(activation_date).
Fixture dates were 2026/06/15, so TestPolicyEngine_hiveForTag_filebased
failed on/after that day. Use 2099/12/31 in tag test JSON so CI stays
stable without changing policy semantics under test.
Co-authored-by: Cursor <[email protected]>
* RANGER-5647: Fix thread-unsafe dynamic path wildcard matching
RecursiveWildcardResourceMatcher reused a shared wildcardPathElements
field when expanding {USER} tokens, causing intermittent deny results
under concurrent policy evaluation (e.g. hdfs_resourcespec in CI).
Co-authored-by: Cursor <[email protected]>
---------
Co-authored-by: ramk <[email protected]>
Co-authored-by: Cursor <[email protected]>
---
.../resourcematcher/RangerPathResourceMatcher.java | 10 ++++++----
.../test/resources/policyengine/ACLResourceTags.json | 8 ++++----
.../test/resources/policyengine/descendant_tags.json | 2 +-
.../resources/policyengine/plugin/resourceTags.json | 8 ++++----
.../test/resources/policyengine/resourceTags.json | 8 ++++----
.../policyengine/test_policyengine_tag_hive.json | 20 ++++++++++----------
6 files changed, 29 insertions(+), 27 deletions(-)
diff --git
a/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerPathResourceMatcher.java
b/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerPathResourceMatcher.java
index fd238db4f..aa8341fae 100644
---
a/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerPathResourceMatcher.java
+++
b/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerPathResourceMatcher.java
@@ -542,16 +542,18 @@ static class RecursiveWildcardResourceMatcher extends
AbstractPathResourceMatche
boolean isMatch(String resourceValue, Map<String, Object> evalContext)
{
LOG.debug("==>
RecursiveWildcardResourceMatcher.isMatch(resourceValue={}, evalContext={})",
resourceValue, evalContext);
- String expandedValue;
+ String expandedValue;
+ String[] pathElements;
if (getNeedsDynamicEval()) {
- expandedValue = getExpandedValue(evalContext);
- wildcardPathElements = StringUtils.split(expandedValue,
pathSeparatorChar);
+ expandedValue = getExpandedValue(evalContext);
+ pathElements = StringUtils.split(expandedValue,
pathSeparatorChar);
} else {
expandedValue = value;
+ pathElements = wildcardPathElements;
}
- boolean ret = function.apply(resourceValue, expandedValue,
pathSeparatorChar, ioCase, wildcardPathElements);
+ boolean ret = function.apply(resourceValue, expandedValue,
pathSeparatorChar, ioCase, pathElements);
LOG.debug("<==
RecursiveWildcardResourceMatcher.isMatch(resourceValue={}, expandedValue={}) :
result:[{}]", resourceValue, expandedValue, ret);
diff --git a/agents-common/src/test/resources/policyengine/ACLResourceTags.json
b/agents-common/src/test/resources/policyengine/ACLResourceTags.json
index 1fa7e89d9..5fd800cd1 100644
--- a/agents-common/src/test/resources/policyengine/ACLResourceTags.json
+++ b/agents-common/src/test/resources/policyengine/ACLResourceTags.json
@@ -43,7 +43,7 @@
"tags": {
"1": {
"type": "EXPIRES_ON",
- "attributes": { "expiry_date": "2026/06/15" },
+ "attributes": { "expiry_date": "2099/12/31" },
"id": 1,
"guid": "tag-expires-on-1-guid"
},
@@ -61,19 +61,19 @@
},
"4": {
"type": "RESTRICTED-FINAL",
- "attributes": { "activation_date": "2026/06/15" },
+ "attributes": { "activation_date": "2099/12/31" },
"id": 4,
"guid": "tag-restricted-final-4-guid"
},
"5": {
"type": "PII",
- "attributes": { "expiry": "2026/06/15" },
+ "attributes": { "expiry": "2099/12/31" },
"id": 5,
"guid": "tag-pii-5-guid"
},
"6": {
"type": "PII-FINAL",
- "attributes": { "expiry": "2026/06/15" },
+ "attributes": { "expiry": "2099/12/31" },
"id": 6,
"guid": "tag-pii-final-6-guid"
},
diff --git a/agents-common/src/test/resources/policyengine/descendant_tags.json
b/agents-common/src/test/resources/policyengine/descendant_tags.json
index 8007c5325..99b4daa10 100644
--- a/agents-common/src/test/resources/policyengine/descendant_tags.json
+++ b/agents-common/src/test/resources/policyengine/descendant_tags.json
@@ -26,7 +26,7 @@
"tags": {
"1": {
"type": "PII",
- "attributes": { "expiry": "2026/06/15" },
+ "attributes": { "expiry": "2099/12/31" },
"id": 1,
"guid": "tag-pii-1-guid"
},
diff --git
a/agents-common/src/test/resources/policyengine/plugin/resourceTags.json
b/agents-common/src/test/resources/policyengine/plugin/resourceTags.json
index 425e9a080..58fec8e24 100644
--- a/agents-common/src/test/resources/policyengine/plugin/resourceTags.json
+++ b/agents-common/src/test/resources/policyengine/plugin/resourceTags.json
@@ -37,7 +37,7 @@
"tags": {
"1": {
"type": "EXPIRES_ON",
- "attributes": { "expiry_date": "2026/06/15" },
+ "attributes": { "expiry_date": "2099/12/31" },
"id": 1,
"guid": "tag-expires-on-1-guid"
},
@@ -55,19 +55,19 @@
},
"4": {
"type": "RESTRICTED-FINAL",
- "attributes": { "activation_date": "2026/06/15" },
+ "attributes": { "activation_date": "2099/12/31" },
"id": 4,
"guid": "tag-restricted-final-4-guid"
},
"5": {
"type": "PII",
- "attributes": { "expiry": "2026/06/15" },
+ "attributes": { "expiry": "2099/12/31" },
"id": 5,
"guid": "tag-pii-5-guid"
},
"6": {
"type": "PII-FINAL",
- "attributes": { "expiry": "2026/06/15" },
+ "attributes": { "expiry": "2099/12/31" },
"id": 6,
"guid": "tag-pii-final-6-guid"
}
diff --git a/agents-common/src/test/resources/policyengine/resourceTags.json
b/agents-common/src/test/resources/policyengine/resourceTags.json
index c564673b3..09625901c 100644
--- a/agents-common/src/test/resources/policyengine/resourceTags.json
+++ b/agents-common/src/test/resources/policyengine/resourceTags.json
@@ -37,7 +37,7 @@
"tags": {
"1": {
"type": "EXPIRES_ON",
- "attributes": { "expiry_date": "2026/06/15" },
+ "attributes": { "expiry_date": "2099/12/31" },
"id": 1,
"guid": "tag-expires-on-1-guid"
},
@@ -55,19 +55,19 @@
},
"4": {
"type": "RESTRICTED-FINAL",
- "attributes": { "activation_date": "2026/06/15" },
+ "attributes": { "activation_date": "2099/12/31" },
"id": 4,
"guid": "tag-restricted-final-4-guid"
},
"5": {
"type": "PII",
- "attributes": { "expiry": "2026/06/15" },
+ "attributes": { "expiry": "2099/12/31" },
"id": 5,
"guid": "tag-pii-5-guid"
},
"6": {
"type": "PII-FINAL",
- "attributes": { "expiry": "2026/06/15" },
+ "attributes": { "expiry": "2099/12/31" },
"id": 6,
"guid": "tag-pii-final-6-guid"
}
diff --git
a/agents-common/src/test/resources/policyengine/test_policyengine_tag_hive.json
b/agents-common/src/test/resources/policyengine/test_policyengine_tag_hive.json
index 0c8ae5d65..47d03ada7 100644
---
a/agents-common/src/test/resources/policyengine/test_policyengine_tag_hive.json
+++
b/agents-common/src/test/resources/policyengine/test_policyengine_tag_hive.json
@@ -241,7 +241,7 @@
"request":{
"resource":{"elements":{"database":"default", "table":"table2"}},
"accessType":"","user":"denieduser","userGroups":[],"requestData":"desc
default.table2;' for denieduser",
- "context": {"TAGS":"[{\"type\":\"PII-FINAL\",
\"attributes\":{\"expiry\":\"2026/06/15\"}}]"}
+ "context": {"TAGS":"[{\"type\":\"PII-FINAL\",
\"attributes\":{\"expiry\":\"2099/12/31\"}}]"}
},
"result":{"isAudited":true,"isAllowed":false,"policyId":103}
},
@@ -292,7 +292,7 @@
"request":{
"resource":{"elements":{"database":"employee", "table":"personal",
"column":"ssn"}},
"accessType":"select","user":"user1","userGroups":[],"requestData":"select ssn
from employee.personal;' for user1",
- "context": {"TAGS":"[{\"type\":\"RESTRICTED\",
\"attributes\":{\"expiry\":\"2026/06/15\"}}]"}
+ "context": {"TAGS":"[{\"type\":\"RESTRICTED\",
\"attributes\":{\"expiry\":\"2099/12/31\"}}]"}
},
"result":{"isAudited":true,"isAllowed":true,"policyId":1}
},
@@ -300,7 +300,7 @@
"request":{
"resource":{"elements":{"database":"employee", "table":"personal",
"column":"ssn"}},
"accessType":"select","user":"user2","userGroups":[],"requestData":"select ssn
from employee.personal;' for user2",
- "context": {"TAGS":"[{\"type\":\"RESTRICTED-FINAL\",
\"attributes\":{\"expiry\":\"2026/06/15\"}}]"}
+ "context": {"TAGS":"[{\"type\":\"RESTRICTED-FINAL\",
\"attributes\":{\"expiry\":\"2099/12/31\"}}]"}
},
"result":{"isAudited":true,"isAllowed":false,"policyId":4}
},
@@ -325,7 +325,7 @@
"request":{
"resource":{"elements":{"database":"default", "table":"table1",
"column":"name"}},
"accessType":"select","user":"hive","userGroups":[],"requestData":"select name
from default.table1;' for hive",
- "context": {"TAGS":"[{\"type\":\"PII\",
\"attributes\":{\"expiry\":\"2026/06/15\"}}]"}
+ "context": {"TAGS":"[{\"type\":\"PII\",
\"attributes\":{\"expiry\":\"2099/12/31\"}}]"}
},
"result":{"isAudited":true,"isAllowed":true,"policyId":2}
},
@@ -333,7 +333,7 @@
"request":{
"resource":{"elements":{"database":"default", "table":"table1"}},
"accessType":"","user":"hive","userGroups":[],"requestData":"desc
default.table1;' for hive",
- "context": {"TAGS":"[{\"type\":\"PII\",
\"attributes\":{\"expiry\":\"2026/06/15\"}}]"}
+ "context": {"TAGS":"[{\"type\":\"PII\",
\"attributes\":{\"expiry\":\"2099/12/31\"}}]"}
},
"result":{"isAudited":true,"isAllowed":true,"policyId":2}
},
@@ -341,7 +341,7 @@
"request":{
"resource":{"elements":{"database":"default", "table":"table1"}},
"accessType":"","user":"user1","userGroups":[],"requestData":"desc
default.table1;' for user1",
- "context": {"TAGS":"[{\"type\":\"PII-FINAL\",
\"attributes\":{\"expiry\":\"2026/06/15\"}}]"}
+ "context": {"TAGS":"[{\"type\":\"PII-FINAL\",
\"attributes\":{\"expiry\":\"2099/12/31\"}}]"}
},
"result":{"isAudited":true,"isAllowed":false,"policyId":3}
},
@@ -349,7 +349,7 @@
"request":{
"resource":{"elements":{"database":"default", "table":"table1"}},
"accessType":"","user":"testuser","userGroups":[],"requestData":"desc
default.table1;' for testuser",
- "context": {"TAGS":"[{\"type\":\"PII-FINAL\",
\"attributes\":{\"expiry\":\"2026/06/15\"}}]"}
+ "context": {"TAGS":"[{\"type\":\"PII-FINAL\",
\"attributes\":{\"expiry\":\"2099/12/31\"}}]"}
},
"result":{"isAudited":true,"isAllowed":false,"policyId":-1}
},
@@ -357,7 +357,7 @@
"request":{
"resource":{"elements":{"database":"default"}},
"accessType":"","user":"hive","userGroups":[],"requestData":"use
default",
- "context": {"TAGS":"[{\"type\":\"PII-FINAL\",
\"attributes\":{\"expiry\":\"2026/06/15\"}}]"}
+ "context": {"TAGS":"[{\"type\":\"PII-FINAL\",
\"attributes\":{\"expiry\":\"2099/12/31\"}}]"}
},
"result":{"isAudited":true,"isAllowed":true,"policyId":101}
},
@@ -365,7 +365,7 @@
"request":{
"resource":{"elements":{"database":"default"}},
"accessType":"","user":"user1","userGroups":[],"requestData":"use
default for user1",
- "context": {"TAGS":"[{\"type\":\"PII-FINAL\",
\"attributes\":{\"expiry\":\"2026/06/15\"}}]"}
+ "context": {"TAGS":"[{\"type\":\"PII-FINAL\",
\"attributes\":{\"expiry\":\"2099/12/31\"}}]"}
},
"result":{"isAudited":true,"isAllowed":false,"policyId":3}
},
@@ -373,7 +373,7 @@
"request":{
"resource":{"elements":{"database":"default", "table":"table1",
"column":"name"}},
"accessType":"select","user":"hive","userGroups":[],"requestData":"select *
from default.table1",
- "context": {"TAGS":"[{\"type\":\"PII\",
\"attributes\":{\"expiry\":\"2026/06/15\"}}]"}
+ "context": {"TAGS":"[{\"type\":\"PII\",
\"attributes\":{\"expiry\":\"2099/12/31\"}}]"}
},
"result":{"isAudited":true,"isAllowed":true,"policyId":2}
},
