[
https://issues.apache.org/jira/browse/HDDS-17298?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Siyao Meng updated HDDS-17298:
------------------------------
Summary: Return INVALID_REQUEST for malformed ACLs in OM requests (was:
Return INVALID_REQUEST for malformed ACLs in OM create requests)
> Return INVALID_REQUEST for malformed ACLs in OM requests
> --------------------------------------------------------
>
> Key: HDDS-17298
> URL: https://issues.apache.org/jira/browse/HDDS-17298
> Project: Apache Ozone
> Issue Type: Bug
> Components: Ozone Manager
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
> Labels: pull-request-available
>
> OM converts the ACLs sent with key, file, directory, multipart upload, bucket
> and volume create requests ({{KeyArgs.acls}}, {{BucketInfo.acls}},
> {{VolumeInfo.volumeAcls}}) with {{OzoneAcl.fromProtobuf}} in
> {{validateAndUpdateCache}}. An ACL with an empty user or group name, a WORLD
> or ANONYMOUS ACL with a different name, or rights longer than 4 bytes fails
> there with {{IllegalArgumentException}} or {{AssertionError}} instead of an
> {{OMException}} with a result code.
> This change:
> * validates client ACLs in {{preExecute}} of the create requests
> ({{OMKeyRequest.resolveBucketAndCheckKeyAcls}}, {{OMBucketCreateRequest}},
> {{OMVolumeCreateRequest}}) and rejects malformed ones with {{INVALID_REQUEST}}
> * converts the ACLs in {{validateAndUpdateCache}} through the same helper, so
> a malformed ACL yields an error response there too
> * throws {{IllegalArgumentException}} instead of {{AssertionError}} in
> {{OzoneAcl.fromProtobuf}}
> Compatibility:
> * The Ozone client and the S3 Gateway build ACLs that already pass this
> validation, so they see no difference.
> * No protocol, version or layout change.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
