vyommani opened a new pull request, #1150: URL: https://github.com/apache/ranger/pull/1150
## What changes were proposed in this pull request? RangerURLResourceMatcher did not match a recursive URL policy against a resource when both were expressed in the scheme:///path form (three slashes after the colon) — the standard way to reference the Hadoop default FileSystem, i.e. a URL with no explicit host/authority. RangerURLResourceMatcher.isPathURLType() rejected any URL whose scheme was followed by 3 or more slashes, mis-classifying the default-FS form as "not a URL." isRecursiveWildCardMatch() short-circuits to false whenever isPathURLType() is false, so path-element comparison never ran for these URLs isPathURLType(): a path-URL is now any scheme: followed by 2 or more slashes, not exactly 2. getScheme() / getPathWithOutScheme(): rather than hard-coding "2 slashes" into the scheme boundary, these now capture all of the slashes immediately following the colon. This is needed for correctness, not just to lift the isPathURLType gate — without it, path-element reconstruction in isRecursiveWildCardMatch collapses the extra slash and a default-FS resource (hdfs:///app/...) could wrongly match a policy scoped to an explicit authority literally named app (hdfs://app/...), or vice versa. Preserving the exact slash count keeps those two forms distinct while letting like-for-like default-FS policy/resource pairs match as expected. The regex used by isPathURLType() is now compiled once into a static final Pattern field rather than per call, matching the existing convention elsewhere in this package (RangerIpMatcher, RangerTimeOfDayMatcher). ## How was this patch tested? Added new tests -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
