Eoin McDonnell created RANGER-5798:
--------------------------------------
Summary: Sanitize Test Connection failure messages to avoid port
reachability disclosure
Key: RANGER-5798
URL: https://issues.apache.org/jira/browse/RANGER-5798
Project: Ranger
Issue Type: Improvement
Components: admin
Reporter: Eoin McDonnell
Assignee: Eoin McDonnell
Ranger Admin "Test Connection" (validateConfig) can disclose whether a
host:port is reachable.
An administrator can enter an arbitrary service URL (for example a NiFi URL
pointing at a non-service port), click Test Connection, and observe distinct
failure details in the UI such as:
java.net.ConnectException: Connection refused
Because the connection is initiated from the Ranger Admin server, this can be
used to infer reachability of internal hosts/ports. Note that literal localhost
/ 127.0.0.1 are already rejected in service configs; using a resolvable
hostname or IP bypasses that check.
Expected behavior:
- Keep Test Connection available and keep service URLs configurable (custom
ports / load balancers are valid).
- On failure, return a generic connection-failure message to the UI.
- Log full exception details only in ranger_admin.log.
- Prefer applying the sanitization on the shared validateConfig / client
response path so all service types benefit, not only NiFi.
Repro (NiFi example):
1. Ranger Admin UI -> Service Manager -> NiFi -> Add service
2. Authentication Type = SSL, use default SSL context = Yes
3. Set nifi.url to https://<ranger-admin-host>:<closed-port>/nifi-api/resources
4. Click Test Connection
5. UI shows Connection refused (or similar low-level exception text)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
