Vyom Mani Tiwari created RANGER-5799:
----------------------------------------
Summary: Validate class assignability before instantiating
configured service-def classes
Key: RANGER-5799
URL: https://issues.apache.org/jira/browse/RANGER-5799
Project: Ranger
Issue Type: Bug
Components: Ranger
Affects Versions: 2.9.0
Reporter: Vyom Mani Tiwari
Assignee: Vyom Mani Tiwari
Fix For: 3.0.0
{{ServiceMgr.getClassForServiceType()}} and
{{RangerPolicyRepository.buildContextEnricher()}} load a configured class name
(service-def {{implClass}} and {{contextEnrichers[].enricher}} respectively)
via {{Class.forName()}} and instantiate it via {{{}newInstance(){}}}, relying
on the compiler-inserted checkcast (to {{RangerBaseService}} /
{{{}RangerContextEnricher{}}}) to catch a misconfigured class name. Since the
cast happens after construction, a misconfigured or unexpected class is fully
constructed before the type mismatch is detected.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
