[
https://issues.apache.org/jira/browse/RANGER-5819?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Vyom Mani Tiwari updated RANGER-5819:
-------------------------------------
Description:
RANGER-5677 made the non-secure {{download}} endpoint URL patterns in
{{security-applicationContext.xml}} slash-insensitive ({{{}/{*}{*}{}}} \{*}→
{{/}}{*}{{{}**{}}}{*}) so that trailing-slash variants resolve to the same
Spring Security rule. That change covered only the {{download/}}{*} endpoints.
The {{{}grant{}}}/{{{}revoke{}}} endpoints still use single-segment {{*}}
patterns and were not included:
{{/service/plugins/services/grant/*
/service/plugins/services/revoke/*
/service/assets/resources/grant
/service/assets/resources/revoke}}
Because Jersey resolves a trailing slash to the same resource method
(sub-resource methods are compiled with an optional {{?}} suffix) while the
Spring Ant matcher {{*}} does not match the trailing-slash form, a request to
these endpoints with a trailing slash is matched by a different filter chain
than the canonical path. This inconsistency should be removed so all variants
of these endpoints resolve to the same, intended rule, matching the treatment
already applied to the download endpoints.
was:
RANGER-5677 made the non-secure {{download}} endpoint URL patterns in
{{security-applicationContext.xml}} slash-insensitive ({{{}/*{}}} →
{{{}/**{}}}) so that trailing-slash variants resolve to the same Spring
Security rule. That change covered only the {{download/*}} endpoints.
The {{{}grant{}}}/{{{}revoke{}}} endpoints still use single-segment {{*}}
patterns and were not included:
{{/service/plugins/services/grant/*
/service/plugins/services/revoke/*
/service/assets/resources/grant
/service/assets/resources/revoke}}
Because Jersey resolves a trailing slash to the same resource method
(sub-resource methods are compiled with an optional {{(/)?}} suffix) while the
Spring Ant matcher {{*}} does not match the trailing-slash form, a request to
these endpoints with a trailing slash is matched by a different filter chain
than the canonical path. This inconsistency should be removed so all variants
of these endpoints resolve to the same, intended rule, matching the treatment
already applied to the download endpoints.
> Make grant/revoke endpoint security patterns slash-insensitive (follow-up to
> RANGER-5677)
> -----------------------------------------------------------------------------------------
>
> Key: RANGER-5819
> URL: https://issues.apache.org/jira/browse/RANGER-5819
> Project: Ranger
> Issue Type: Improvement
> Components: Ranger
> Affects Versions: 2.8.0, 2.9.0
> Reporter: Vyom Mani Tiwari
> Assignee: Vyom Mani Tiwari
> Priority: Major
>
> RANGER-5677 made the non-secure {{download}} endpoint URL patterns in
> {{security-applicationContext.xml}} slash-insensitive ({{{}/{*}{*}{}}} \{*}→
> {{/}}{*}{{{}**{}}}{*}) so that trailing-slash variants resolve to the same
> Spring Security rule. That change covered only the {{download/}}{*} endpoints.
> The {{{}grant{}}}/{{{}revoke{}}} endpoints still use single-segment {{*}}
> patterns and were not included:
>
> {{/service/plugins/services/grant/*
> /service/plugins/services/revoke/*
> /service/assets/resources/grant
> /service/assets/resources/revoke}}
> Because Jersey resolves a trailing slash to the same resource method
> (sub-resource methods are compiled with an optional {{?}} suffix) while the
> Spring Ant matcher {{*}} does not match the trailing-slash form, a request to
> these endpoints with a trailing slash is matched by a different filter chain
> than the canonical path. This inconsistency should be removed so all variants
> of these endpoints resolve to the same, intended rule, matching the treatment
> already applied to the download endpoints.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
