[
https://issues.apache.org/jira/browse/RANGER-5818?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Vyom Mani Tiwari updated RANGER-5818:
-------------------------------------
Description:
Use the common script engine for nestedstructure row-filter evaluation
RecordFilterJavaScript in plugin-nestedstructure evaluates row-filter
expressions with its own script engine. Policy-condition scripts go through
ScriptEngineUtil in agents-common. Use that path here so the two stay aligned.
ranger-2.x (2.9, 2.8):
* Create the engine with ScriptEngineUtil, as RangerRequestScriptEvaluator does.
* Run the same pre-execution script RangerRequestScriptEvaluator runs, from one
shared constant.
master:
* Remove the nashorn-core dependency from plugin-nestedstructure. Nashorn was
removed from Ranger in RANGER-4076.
* If the common engine cannot be created, fail with MaskingException.
* Run the same pre-execution script as on 2.x.
was:
{{RecordFilterJavaScript}} in {{plugin-nestedstructure}} evaluates row-filter
expressions with a script engine it creates itself. The rest of Ranger uses the
common {{ScriptEngineUtil}} / {{ScriptEngineCreator}} path in {{agents-common}}
for this. As a result, the plugin's engine configuration and its handling of
script pre-execution have drifted from {{{}RangerRequestScriptEvaluator{}}}.
_ranger-2.x (2.10, 2.9, 2.8):_
* Create the engine through the common {{ScriptEngineUtil}} /
{{NashornScriptEngineCreator}} instead of instantiating
{{NashornScriptEngineFactory}} directly, so it gets the same engine arguments
and class filter as policy-condition scripts.
* Apply the same safe pre-execution script that
{{RangerRequestScriptEvaluator}} uses before evaluating the row-filter
expression. Move it into a shared constant so it isn't duplicated.
* Keep the existing expression check only as an additional check; it should
not be the primary control.
_master:_
* Remove the {{nashorn-core}} dependency from {{plugin-nestedstructure}} and
the {{{}nashorn{}}}/{{{}js{}}} fallback in {{{}resolveJavaScriptEngine(){}}}.
Nashorn has otherwise been removed from Ranger (RANGER-4076).
* Fail with {{MaskingException}} when the Graal.js engine is not available,
instead of falling back to another engine.
* Apply the engine options to the bindings actually used for evaluation. Today
they are set on the engine-scope bindings, while {{eval()}} runs on a separate
{{createBindings()}} instance.
* Apply the same safe pre-execution script as on 2.x.
> Use the common hardened script engine for nestedstructure row-filter
> evaluation
> -------------------------------------------------------------------------------
>
> Key: RANGER-5818
> URL: https://issues.apache.org/jira/browse/RANGER-5818
> Project: Ranger
> Issue Type: Improvement
> Components: plugins
> Affects Versions: 2.8.0, 2.9.0
> Reporter: Vyom Mani Tiwari
> Assignee: Vyom Mani Tiwari
> Priority: Major
> Fix For: 3.0.0
>
>
> Use the common script engine for nestedstructure row-filter evaluation
> RecordFilterJavaScript in plugin-nestedstructure evaluates row-filter
> expressions with its own script engine. Policy-condition scripts go through
> ScriptEngineUtil in agents-common. Use that path here so the two stay aligned.
> ranger-2.x (2.9, 2.8):
> * Create the engine with ScriptEngineUtil, as RangerRequestScriptEvaluator
> does.
> * Run the same pre-execution script RangerRequestScriptEvaluator runs, from
> one shared constant.
> master:
> * Remove the nashorn-core dependency from plugin-nestedstructure. Nashorn was
> removed from Ranger in RANGER-4076.
> * If the common engine cannot be created, fail with MaskingException.
> * Run the same pre-execution script as on 2.x.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
