[
https://issues.apache.org/jira/browse/JENA-2055?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17292906#comment-17292906
]
Claude Warren commented on JENA-2055:
-------------------------------------
I have two items to bring up here:
*One – The record code for OperationDeniedException*
I think there is a problem with the original solution. If the problem is that
authentication is required the system returns a 403 (forbidden) rather than a
401 (unauthorized). The issue in in the patch at the line that reads:
{code:java}
if ( ex.getCause() != null && ex.getCause() instanceof OperationDeniedException
){code}
The code that follows should distinguish between the AccessDenied and the
AuthenticationRequired exceptions. I think that CannotCreate should proibably
go with AccessDenied.
*Two – The permissions issue in UNION*
The work around for this problem is to modify the SecurityEvaluator.
Background:
The system verifies that the user has access to the graph, if not it throws the
ReadDeniedException. However, if the user has access to the graph then the
system will look at each triple and verify access. So if the SecurityEvaluator
returns true for graph access and then false for every triple the system will
work.
The solution is probably to change the find() methods so that hey call
canRead() rather than checkRead() and if canRead() returns false then return an
empty iterator..
> handle properly the denied access generated by jena-permission security
> evaluator
> ---------------------------------------------------------------------------------
>
> Key: JENA-2055
> URL: https://issues.apache.org/jira/browse/JENA-2055
> Project: Apache Jena
> Issue Type: Bug
> Components: Fuseki
> Affects Versions: Jena 3.17.0
> Environment: jena-fuseki 3.17.0
> openjdk version "1.8.0_275"
> Reporter: info parlepeuple
> Assignee: Andy Seaborne
> Priority: Major
> Labels: fuseki2, permission
> Fix For: Jena 4.0.0
>
> Attachments:
> 0001-handle-properly-the-denied-access-generated-by-jena.patch,
> ShiroEvaluator.java, localData.ttl, pom.xml
>
>
> When the dataset is secured with [jena
> permission|https://jena.apache.org/documentation/permissions/] , and some
> access is denied, an exception is thrown from the SecuredGraph.
> This exception is not catched in SPARQLQueryProcessor, which results in a 500
> error returned to the HTTP client.
> exception OperationDeniedException should return a 403, not a 500.
>
> attached is the patch !
>
> [2021-02-21 03:10:26] Fuseki WARN [3] RC = 500 : Model permissions violation:
> org.apache.jena.shared.ReadDeniedException: Model permissions violation:
> at
> org.apache.jena.permissions.impl.SecuredItemImpl.checkRead(SecuredItemImpl.java:683)
> ~[jena-permissions-3.17.0.jar:3.17.0]
> at
> org.apache.jena.permissions.graph.impl.SecuredGraphImpl.find(SecuredGraphImpl.java:154)
> ~[jena-permissions-3.17.0.jar:3.17.0]
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_275]
> at
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
> ~[?:1.8.0_275]
> at
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> ~[?:1.8.0_275]
> at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_275]
> at
> org.apache.jena.permissions.impl.SecuredItemInvoker.invoke(SecuredItemInvoker.java:120)
> ~[jena-permissions-3.17.0.jar:3.17.0]
> at com.sun.proxy.$Proxy18.find(Unknown Source) ~[?:?]
> at
> org.apache.jena.sparql.graph.GraphUnionRead.graphBaseFind(GraphUnionRead.java:104)
> ~[fuseki-server.jar:3.17.0]
> at org.apache.jena.graph.impl.GraphBase.find(GraphBase.java:244)
> ~[fuseki-server.jar:3.17.0]
> at org.apache.jena.graph.impl.GraphBase.graphBaseFind(GraphBase.java:261)
> ~[fuseki-server.jar:3.17.0]
> at org.apache.jena.graph.impl.GraphBase.find(GraphBase.java:258)
> ~[fuseki-server.jar:3.17.0]
> at org.apache.jena.graph.impl.WrappedGraph.find(WrappedGraph.java:100)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.sparql.engine.iterator.QueryIterTriplePattern$TripleMapper.<init>(QueryIterTriplePattern.java:83)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.sparql.engine.iterator.QueryIterTriplePattern.nextStage(QueryIterTriplePattern.java:52)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.sparql.engine.iterator.QueryIterRepeatApply.makeNextStage(QueryIterRepeatApply.java:108)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.sparql.engine.iterator.QueryIterRepeatApply.hasNextBinding(QueryIterRepeatApply.java:65)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.sparql.engine.iterator.QueryIteratorBase.hasNext(QueryIteratorBase.java:114)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.sparql.engine.iterator.QueryIterBlockTriplesStar.hasNextBinding(QueryIterBlockTriplesStar.java:54)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.sparql.engine.iterator.QueryIteratorBase.hasNext(QueryIteratorBase.java:114)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.sparql.engine.iterator.QueryIterConvert.hasNextBinding(QueryIterConvert.java:58)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.sparql.engine.iterator.QueryIteratorBase.hasNext(QueryIteratorBase.java:114)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.sparql.engine.iterator.QueryIteratorWrapper.hasNextBinding(QueryIteratorWrapper.java:38)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.sparql.engine.iterator.QueryIteratorBase.hasNext(QueryIteratorBase.java:114)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.sparql.engine.iterator.QueryIteratorWrapper.hasNextBinding(QueryIteratorWrapper.java:38)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.sparql.engine.iterator.QueryIteratorBase.hasNext(QueryIteratorBase.java:114)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.sparql.engine.ResultSetStream.hasNext(ResultSetStream.java:74)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.sparql.engine.ResultSetCheckCondition.hasNext(ResultSetCheckCondition.java:55)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.fuseki.servlets.SPARQLQueryProcessor.executeQuery(SPARQLQueryProcessor.java:324)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.fuseki.servlets.SPARQLQueryProcessor.execute(SPARQLQueryProcessor.java:273)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.fuseki.servlets.SPARQLQueryProcessor.executeWithParameter(SPARQLQueryProcessor.java:222)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.fuseki.servlets.SPARQLQueryProcessor.execute(SPARQLQueryProcessor.java:207)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.fuseki.servlets.ActionService.executeLifecycle(ActionService.java:58)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.fuseki.servlets.SPARQLQueryProcessor.execPost(SPARQLQueryProcessor.java:83)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.fuseki.servlets.ActionProcessor.process(ActionProcessor.java:34)
> ~[fuseki-server.jar:3.17.0]
> at org.apache.jena.fuseki.servlets.ActionBase.process(ActionBase.java:55)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.fuseki.servlets.ActionExecLib.execAction(ActionExecLib.java:106)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.fuseki.server.Dispatcher.dispatchAction(Dispatcher.java:118)
> ~[fuseki-server.jar:3.17.0]
> at org.apache.jena.fuseki.server.Dispatcher.process(Dispatcher.java:110)
> ~[fuseki-server.jar:3.17.0]
> at org.apache.jena.fuseki.server.Dispatcher.dispatch(Dispatcher.java:96)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.fuseki.servlets.FusekiFilter.doFilter(FusekiFilter.java:51)
> ~[fuseki-server.jar:3.17.0]
> at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
> ~[fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:61)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:450)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.web.servlet.AbstractShiroFilter$1.call(AbstractShiroFilter.java:365)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.subject.support.SubjectCallable.doCall(SubjectCallable.java:90)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.subject.support.SubjectCallable.call(SubjectCallable.java:83)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.subject.support.DelegatingSubject.execute(DelegatingSubject.java:387)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:362)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
> ~[fuseki-server.jar:3.17.0]
> at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
> ~[fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.fuseki.servlets.CrossOriginFilter.handle(CrossOriginFilter.java:284)
> ~[fuseki-server.jar:3.17.0]
> at
> org.apache.jena.fuseki.servlets.CrossOriginFilter.doFilter(CrossOriginFilter.java:247)
> ~[fuseki-server.jar:3.17.0]
> at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:201)
> ~[fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
> ~[fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:548)
> ~[fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
> ~[fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:602)
> ~[fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
> ~[fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235)
> ~[fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1612)
> ~[fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233)
> ~[fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1434)
> ~[fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188)
> ~[fuseki-server.jar:3.17.0]
> at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:501)
> ~[fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1582)
> ~[fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186)
> ~[fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1349)
> ~[fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
> ~[fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:716)
> ~[fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
> ~[fuseki-server.jar:3.17.0]
> at org.eclipse.jetty.server.Server.handle(Server.java:516)
> ~[fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:383)
> ~[fuseki-server.jar:3.17.0]
> at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:556)
> [fuseki-server.jar:3.17.0]
> at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:375)
> [fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:273)
> [fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311)
> [fuseki-server.jar:3.17.0]
> at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)
> [fuseki-server.jar:3.17.0]
> at org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104)
> [fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:336)
> [fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:313)
> [fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:171)
> [fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:129)
> [fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:375)
> [fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:773)
> [fuseki-server.jar:3.17.0]
> at
> org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:905)
> [fuseki-server.jar:3.17.0]
> at java.lang.Thread.run(Thread.java:748) [?:1.8.0_275]
> [2021-02-21 03:10:26] Fuseki INFO [3] 500 Server Error (18 ms)
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
