Vyom Mani Tiwari created RANGER-5819:
----------------------------------------
Summary: Make grant/revoke endpoint security patterns
slash-insensitive (follow-up to RANGER-5677)
Key: RANGER-5819
URL: https://issues.apache.org/jira/browse/RANGER-5819
Project: Ranger
Issue Type: Improvement
Components: Ranger
Affects Versions: 2.9.0, 2.8.0
Reporter: Vyom Mani Tiwari
Assignee: Vyom Mani Tiwari
RANGER-5677 made the non-secure {{download}} endpoint URL patterns in
{{security-applicationContext.xml}} slash-insensitive ({{{}/*{}}} →
{{{}/**{}}}) so that trailing-slash variants resolve to the same Spring
Security rule. That change covered only the {{download/*}} endpoints.
The {{{}grant{}}}/{{{}revoke{}}} endpoints still use single-segment {{*}}
patterns and were not included:
{{/service/plugins/services/grant/*
/service/plugins/services/revoke/*
/service/assets/resources/grant
/service/assets/resources/revoke}}
Because Jersey resolves a trailing slash to the same resource method
(sub-resource methods are compiled with an optional {{(/)?}} suffix) while the
Spring Ant matcher {{*}} does not match the trailing-slash form, a request to
these endpoints with a trailing slash is matched by a different filter chain
than the canonical path. This inconsistency should be removed so all variants
of these endpoints resolve to the same, intended rule, matching the treatment
already applied to the download endpoints.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
