vyommani opened a new pull request, #1284: URL: https://github.com/apache/ranger/pull/1284
…sitive (follow-up to RANGER-5677) ## What changes were proposed in this pull request? RANGER-5819. Follow-up to RANGER-5677. security="none" for the open grant and revoke endpoints did not cover a trailing slash. The plugin patterns were a single-segment wildcard (/*), and the AssetREST patterns were exact. A trailing slash missed those patterns and fell through to the authenticated filter chain, so the same URL was handled differently with and without the slash. This widens those four patterns to /**, the same treatment RANGER-5677 applied to the download endpoints: • /service/plugins/services/grant/** • /service/plugins/services/revoke/** • /service/assets/resources/grant/** • /service/assets/resources/revoke/** The canonical path still matches. No change to grantAccess or revokeAccess. ## How was this patch tested? TestGrantRevokeSecurityNonePatterns reads security-applicationContext.xml and checks each pattern with Spring's AntPathRequestMatcher. Each path matches with and without a trailing slash. It also checks that a hand-made /service/plugins/services/grant/* matcher does not match the trailing-slash path. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
