This is an automated email from the ASF dual-hosted git repository. ramackri pushed a commit to branch RANGER-5647-backport-ranger-2.9 in repository https://gitbox.apache.org/repos/asf/ranger.git
commit 597b6e00ff54286ee611c05621396e8492d0e413 Author: ramk <[email protected]> AuthorDate: Sat Jul 4 21:18:07 2026 +0530 RANGER-5647: Backport tag policy test fixtures and path matcher fix to ranger-2.9 Backport of #1018 to ranger-2.9. - Update slash-format tag fixture dates from 2026/06/15 to 2099/12/31 so date-bound tag policy engine tests stay stable after the cutoff date. - Fix thread-unsafe dynamic path wildcard matching in RecursiveWildcardResourceMatcher by using local pathElements per isMatch() call instead of rewriting the shared wildcardPathElements field. Co-authored-by: Cursor <[email protected]> --- .../resourcematcher/RangerPathResourceMatcher.java | 8 +++++--- .../test/resources/policyengine/ACLResourceTags.json | 8 ++++---- .../test/resources/policyengine/descendant_tags.json | 2 +- .../resources/policyengine/plugin/resourceTags.json | 8 ++++---- .../test/resources/policyengine/resourceTags.json | 8 ++++---- .../policyengine/test_policyengine_tag_hive.json | 20 ++++++++++---------- 6 files changed, 28 insertions(+), 26 deletions(-) diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerPathResourceMatcher.java b/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerPathResourceMatcher.java index 2778b204b..3ca364373 100644 --- a/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerPathResourceMatcher.java +++ b/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerPathResourceMatcher.java @@ -591,15 +591,17 @@ boolean isMatch(String resourceValue, Map<String, Object> evalContext) { if (LOG.isDebugEnabled()) { LOG.debug("==> RecursiveWildcardResourceMatcher.isMatch(resourceValue=" + resourceValue + ", evalContext=" + evalContext + ")"); } - String expandedValue; + String expandedValue; + String[] pathElements; if (getNeedsDynamicEval()) { expandedValue = getExpandedValue(evalContext); - wildcardPathElements = StringUtils.split(expandedValue, pathSeparatorChar); + pathElements = StringUtils.split(expandedValue, pathSeparatorChar); } else { expandedValue = value; + pathElements = wildcardPathElements; } - boolean ret = function.apply(resourceValue, expandedValue, pathSeparatorChar, ioCase, wildcardPathElements); + boolean ret = function.apply(resourceValue, expandedValue, pathSeparatorChar, ioCase, pathElements); if (LOG.isDebugEnabled()) { LOG.debug("<== RecursiveWildcardResourceMatcher.isMatch(resourceValue=" + resourceValue + ", expandedValue=" + expandedValue + ") : result:[" + ret + "]"); diff --git a/agents-common/src/test/resources/policyengine/ACLResourceTags.json b/agents-common/src/test/resources/policyengine/ACLResourceTags.json index 1fa7e89d9..5fd800cd1 100644 --- a/agents-common/src/test/resources/policyengine/ACLResourceTags.json +++ b/agents-common/src/test/resources/policyengine/ACLResourceTags.json @@ -43,7 +43,7 @@ "tags": { "1": { "type": "EXPIRES_ON", - "attributes": { "expiry_date": "2026/06/15" }, + "attributes": { "expiry_date": "2099/12/31" }, "id": 1, "guid": "tag-expires-on-1-guid" }, @@ -61,19 +61,19 @@ }, "4": { "type": "RESTRICTED-FINAL", - "attributes": { "activation_date": "2026/06/15" }, + "attributes": { "activation_date": "2099/12/31" }, "id": 4, "guid": "tag-restricted-final-4-guid" }, "5": { "type": "PII", - "attributes": { "expiry": "2026/06/15" }, + "attributes": { "expiry": "2099/12/31" }, "id": 5, "guid": "tag-pii-5-guid" }, "6": { "type": "PII-FINAL", - "attributes": { "expiry": "2026/06/15" }, + "attributes": { "expiry": "2099/12/31" }, "id": 6, "guid": "tag-pii-final-6-guid" }, diff --git a/agents-common/src/test/resources/policyengine/descendant_tags.json b/agents-common/src/test/resources/policyengine/descendant_tags.json index 8007c5325..99b4daa10 100644 --- a/agents-common/src/test/resources/policyengine/descendant_tags.json +++ b/agents-common/src/test/resources/policyengine/descendant_tags.json @@ -26,7 +26,7 @@ "tags": { "1": { "type": "PII", - "attributes": { "expiry": "2026/06/15" }, + "attributes": { "expiry": "2099/12/31" }, "id": 1, "guid": "tag-pii-1-guid" }, diff --git a/agents-common/src/test/resources/policyengine/plugin/resourceTags.json b/agents-common/src/test/resources/policyengine/plugin/resourceTags.json index 425e9a080..58fec8e24 100644 --- a/agents-common/src/test/resources/policyengine/plugin/resourceTags.json +++ b/agents-common/src/test/resources/policyengine/plugin/resourceTags.json @@ -37,7 +37,7 @@ "tags": { "1": { "type": "EXPIRES_ON", - "attributes": { "expiry_date": "2026/06/15" }, + "attributes": { "expiry_date": "2099/12/31" }, "id": 1, "guid": "tag-expires-on-1-guid" }, @@ -55,19 +55,19 @@ }, "4": { "type": "RESTRICTED-FINAL", - "attributes": { "activation_date": "2026/06/15" }, + "attributes": { "activation_date": "2099/12/31" }, "id": 4, "guid": "tag-restricted-final-4-guid" }, "5": { "type": "PII", - "attributes": { "expiry": "2026/06/15" }, + "attributes": { "expiry": "2099/12/31" }, "id": 5, "guid": "tag-pii-5-guid" }, "6": { "type": "PII-FINAL", - "attributes": { "expiry": "2026/06/15" }, + "attributes": { "expiry": "2099/12/31" }, "id": 6, "guid": "tag-pii-final-6-guid" } diff --git a/agents-common/src/test/resources/policyengine/resourceTags.json b/agents-common/src/test/resources/policyengine/resourceTags.json index c564673b3..09625901c 100644 --- a/agents-common/src/test/resources/policyengine/resourceTags.json +++ b/agents-common/src/test/resources/policyengine/resourceTags.json @@ -37,7 +37,7 @@ "tags": { "1": { "type": "EXPIRES_ON", - "attributes": { "expiry_date": "2026/06/15" }, + "attributes": { "expiry_date": "2099/12/31" }, "id": 1, "guid": "tag-expires-on-1-guid" }, @@ -55,19 +55,19 @@ }, "4": { "type": "RESTRICTED-FINAL", - "attributes": { "activation_date": "2026/06/15" }, + "attributes": { "activation_date": "2099/12/31" }, "id": 4, "guid": "tag-restricted-final-4-guid" }, "5": { "type": "PII", - "attributes": { "expiry": "2026/06/15" }, + "attributes": { "expiry": "2099/12/31" }, "id": 5, "guid": "tag-pii-5-guid" }, "6": { "type": "PII-FINAL", - "attributes": { "expiry": "2026/06/15" }, + "attributes": { "expiry": "2099/12/31" }, "id": 6, "guid": "tag-pii-final-6-guid" } diff --git a/agents-common/src/test/resources/policyengine/test_policyengine_tag_hive.json b/agents-common/src/test/resources/policyengine/test_policyengine_tag_hive.json index 0c8ae5d65..47d03ada7 100644 --- a/agents-common/src/test/resources/policyengine/test_policyengine_tag_hive.json +++ b/agents-common/src/test/resources/policyengine/test_policyengine_tag_hive.json @@ -241,7 +241,7 @@ "request":{ "resource":{"elements":{"database":"default", "table":"table2"}}, "accessType":"","user":"denieduser","userGroups":[],"requestData":"desc default.table2;' for denieduser", - "context": {"TAGS":"[{\"type\":\"PII-FINAL\", \"attributes\":{\"expiry\":\"2026/06/15\"}}]"} + "context": {"TAGS":"[{\"type\":\"PII-FINAL\", \"attributes\":{\"expiry\":\"2099/12/31\"}}]"} }, "result":{"isAudited":true,"isAllowed":false,"policyId":103} }, @@ -292,7 +292,7 @@ "request":{ "resource":{"elements":{"database":"employee", "table":"personal", "column":"ssn"}}, "accessType":"select","user":"user1","userGroups":[],"requestData":"select ssn from employee.personal;' for user1", - "context": {"TAGS":"[{\"type\":\"RESTRICTED\", \"attributes\":{\"expiry\":\"2026/06/15\"}}]"} + "context": {"TAGS":"[{\"type\":\"RESTRICTED\", \"attributes\":{\"expiry\":\"2099/12/31\"}}]"} }, "result":{"isAudited":true,"isAllowed":true,"policyId":1} }, @@ -300,7 +300,7 @@ "request":{ "resource":{"elements":{"database":"employee", "table":"personal", "column":"ssn"}}, "accessType":"select","user":"user2","userGroups":[],"requestData":"select ssn from employee.personal;' for user2", - "context": {"TAGS":"[{\"type\":\"RESTRICTED-FINAL\", \"attributes\":{\"expiry\":\"2026/06/15\"}}]"} + "context": {"TAGS":"[{\"type\":\"RESTRICTED-FINAL\", \"attributes\":{\"expiry\":\"2099/12/31\"}}]"} }, "result":{"isAudited":true,"isAllowed":false,"policyId":4} }, @@ -325,7 +325,7 @@ "request":{ "resource":{"elements":{"database":"default", "table":"table1", "column":"name"}}, "accessType":"select","user":"hive","userGroups":[],"requestData":"select name from default.table1;' for hive", - "context": {"TAGS":"[{\"type\":\"PII\", \"attributes\":{\"expiry\":\"2026/06/15\"}}]"} + "context": {"TAGS":"[{\"type\":\"PII\", \"attributes\":{\"expiry\":\"2099/12/31\"}}]"} }, "result":{"isAudited":true,"isAllowed":true,"policyId":2} }, @@ -333,7 +333,7 @@ "request":{ "resource":{"elements":{"database":"default", "table":"table1"}}, "accessType":"","user":"hive","userGroups":[],"requestData":"desc default.table1;' for hive", - "context": {"TAGS":"[{\"type\":\"PII\", \"attributes\":{\"expiry\":\"2026/06/15\"}}]"} + "context": {"TAGS":"[{\"type\":\"PII\", \"attributes\":{\"expiry\":\"2099/12/31\"}}]"} }, "result":{"isAudited":true,"isAllowed":true,"policyId":2} }, @@ -341,7 +341,7 @@ "request":{ "resource":{"elements":{"database":"default", "table":"table1"}}, "accessType":"","user":"user1","userGroups":[],"requestData":"desc default.table1;' for user1", - "context": {"TAGS":"[{\"type\":\"PII-FINAL\", \"attributes\":{\"expiry\":\"2026/06/15\"}}]"} + "context": {"TAGS":"[{\"type\":\"PII-FINAL\", \"attributes\":{\"expiry\":\"2099/12/31\"}}]"} }, "result":{"isAudited":true,"isAllowed":false,"policyId":3} }, @@ -349,7 +349,7 @@ "request":{ "resource":{"elements":{"database":"default", "table":"table1"}}, "accessType":"","user":"testuser","userGroups":[],"requestData":"desc default.table1;' for testuser", - "context": {"TAGS":"[{\"type\":\"PII-FINAL\", \"attributes\":{\"expiry\":\"2026/06/15\"}}]"} + "context": {"TAGS":"[{\"type\":\"PII-FINAL\", \"attributes\":{\"expiry\":\"2099/12/31\"}}]"} }, "result":{"isAudited":true,"isAllowed":false,"policyId":-1} }, @@ -357,7 +357,7 @@ "request":{ "resource":{"elements":{"database":"default"}}, "accessType":"","user":"hive","userGroups":[],"requestData":"use default", - "context": {"TAGS":"[{\"type\":\"PII-FINAL\", \"attributes\":{\"expiry\":\"2026/06/15\"}}]"} + "context": {"TAGS":"[{\"type\":\"PII-FINAL\", \"attributes\":{\"expiry\":\"2099/12/31\"}}]"} }, "result":{"isAudited":true,"isAllowed":true,"policyId":101} }, @@ -365,7 +365,7 @@ "request":{ "resource":{"elements":{"database":"default"}}, "accessType":"","user":"user1","userGroups":[],"requestData":"use default for user1", - "context": {"TAGS":"[{\"type\":\"PII-FINAL\", \"attributes\":{\"expiry\":\"2026/06/15\"}}]"} + "context": {"TAGS":"[{\"type\":\"PII-FINAL\", \"attributes\":{\"expiry\":\"2099/12/31\"}}]"} }, "result":{"isAudited":true,"isAllowed":false,"policyId":3} }, @@ -373,7 +373,7 @@ "request":{ "resource":{"elements":{"database":"default", "table":"table1", "column":"name"}}, "accessType":"select","user":"hive","userGroups":[],"requestData":"select * from default.table1", - "context": {"TAGS":"[{\"type\":\"PII\", \"attributes\":{\"expiry\":\"2026/06/15\"}}]"} + "context": {"TAGS":"[{\"type\":\"PII\", \"attributes\":{\"expiry\":\"2099/12/31\"}}]"} }, "result":{"isAudited":true,"isAllowed":true,"policyId":2} },
