[
https://issues.apache.org/jira/browse/RANGER-1198?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Pradeep Agrawal reassigned RANGER-1198:
---------------------------------------
Assignee: Pradeep Agrawal
> REST API: 404 while retrieving and updating a policy with a slash in the name
> -----------------------------------------------------------------------------
>
> Key: RANGER-1198
> URL: https://issues.apache.org/jira/browse/RANGER-1198
> Project: Ranger
> Issue Type: Bug
> Affects Versions: 0.6.0, 0.7.0, 0.6.1
> Reporter: André Frimberger
> Assignee: Pradeep Agrawal
> Priority: Major
>
> A policy, which is created via Ranger's admin UI can contain slashes, e.g.
> ("MyPolicy Read/Execute" or "/tmp/some/test"). However, updating or
> retrieving such a policy via the REST API _fails_ with a _Bad Request_ or
> _Not found_.
> For retrieving ({{GET}}) and updating ({{PUT}}) a policy, its name is
> transferred as {{@PathParam}}:
> {code}
> @Path("/api/service/{servicename}/policy/{policyname}")
> {code}
> Obviously, {{@PathParam}} parameters shouldn't contain slashes, because
> they're interpreted as path separators. URL encoding {{policyname}} doesn't
> work (Bad Request is returned), either. Due to security implications
> (Directoy traversal attack -
> https://en.wikipedia.org/wiki/Directory_traversal_attack) Tomcat filters %2F
> from the URL path.
> I suggest to pass {{servicename}} and {{policyname}} as "query" or in case of
> updating in the message body.
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
