Vyom Mani Tiwari created RANGER-5850:
----------------------------------------
Summary: Validate nested role membership for cycles and avoid
recursive role expansion in RoleREST
Key: RANGER-5850
URL: https://issues.apache.org/jira/browse/RANGER-5850
Project: Ranger
Issue Type: Bug
Components: Ranger
Affects Versions: 2.9.0
Reporter: Vyom Mani Tiwari
Assignee: Vyom Mani Tiwari
Fix For: 3.0.0
Ranger roles can contain other roles. Today the server doesn’t validate this
nesting when a role is saved, so a role can end up containing itself, directly
or through other roles. Paths that create, update, import or grant roles all
accept such a configuration. One of them, granting a role into itself, isn’t
caught by the existing check in {{{}addUsersGroupsAndRoles{}}}.
Several RoleREST helpers expand nested roles recursively without tracking which
roles they’ve already visited. When the role graph contains a cycle, those
requests fail instead of returning a result. The plugin-side
{{RangerRolesUtil}} already handles this case safely.
Proposed changes:
* Reject role create and update in {{RoleDBStore}} when the nested roles would
make a role contain itself, directly or transitively, including on rename.
* Reject granting a role into itself.
* Make nested-role expansion in RoleREST iterative, with a visited set, so
existing data with cycles is handled safely.
* Add unit tests.
Note: after this change, updating a role that already sits in a nested-role
cycle is rejected until the cycle is removed.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
