Vyom Mani Tiwari created RANGER-5818:
----------------------------------------
Summary: Use the common hardened script engine for nestedstructure
row-filter evaluation
Key: RANGER-5818
URL: https://issues.apache.org/jira/browse/RANGER-5818
Project: Ranger
Issue Type: Improvement
Components: plugins
Affects Versions: 2.9.0, 2.8.0
Reporter: Vyom Mani Tiwari
Assignee: Vyom Mani Tiwari
Fix For: 3.0.0
{{RecordFilterJavaScript}} in {{plugin-nestedstructure}} evaluates row-filter
expressions with a script engine it creates itself. The rest of Ranger uses the
common {{ScriptEngineUtil}} / {{ScriptEngineCreator}} path in {{agents-common}}
for this. As a result, the plugin's engine configuration and its handling of
script pre-execution have drifted from {{{}RangerRequestScriptEvaluator{}}}.
_ranger-2.x (2.10, 2.9, 2.8):_
* Create the engine through the common {{ScriptEngineUtil}} /
{{NashornScriptEngineCreator}} instead of instantiating
{{NashornScriptEngineFactory}} directly, so it gets the same engine arguments
and class filter as policy-condition scripts.
* Apply the same safe pre-execution script that
{{RangerRequestScriptEvaluator}} uses before evaluating the row-filter
expression. Move it into a shared constant so it isn't duplicated.
* Keep the existing expression check only as an additional check; it should
not be the primary control.
_master:_
* Remove the {{nashorn-core}} dependency from {{plugin-nestedstructure}} and
the {{{}nashorn{}}}/{{{}js{}}} fallback in {{{}resolveJavaScriptEngine(){}}}.
Nashorn has otherwise been removed from Ranger (RANGER-4076).
* Fail with {{MaskingException}} when the Graal.js engine is not available,
instead of falling back to another engine.
* Apply the engine options to the bindings actually used for evaluation. Today
they are set on the engine-scope bindings, while {{eval()}} runs on a separate
{{createBindings()}} instance.
* Apply the same safe pre-execution script as on 2.x.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
