pradeepagrawal8184 commented on code in PR #916:
URL: https://github.com/apache/ranger/pull/916#discussion_r4103668328
##########
security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java:
##########
@@ -445,9 +455,100 @@ Long parseLong(String str) {
}
}
- private static URL getValidURL(String urlString) {
+ private static String extractHost(String urlString) {
+ try {
+ String processedUrl = urlString.trim().replaceFirst("(?i)^jdbc:",
"");
+ if (!processedUrl.contains("://")) {
+ processedUrl = "http://"; + processedUrl;
+ }
+
+ processedUrl =
processedUrl.replaceFirst("://([0-9a-fA-F:]+):(\\d+)(/.*)?$", "://[$1]:$2$3");
+
+ URI uri = new URI(processedUrl);
+ String host = uri.getHost();
Review Comment:
uri.getHost() is used first; @ stripping in authority runs only when host ==
null (line 470:475:...). URLs like http://[email protected]/ can
yield host external.example.com and pass code of line 214:215:....
##########
security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java:
##########
@@ -445,9 +455,100 @@ Long parseLong(String str) {
}
}
- private static URL getValidURL(String urlString) {
+ private static String extractHost(String urlString) {
+ try {
+ String processedUrl = urlString.trim().replaceFirst("(?i)^jdbc:",
"");
+ if (!processedUrl.contains("://")) {
+ processedUrl = "http://"; + processedUrl;
+ }
+
+ processedUrl =
processedUrl.replaceFirst("://([0-9a-fA-F:]+):(\\d+)(/.*)?$", "://[$1]:$2$3");
+
+ URI uri = new URI(processedUrl);
+ String host = uri.getHost();
+
+ if (host == null && uri.getAuthority() != null) {
+ host = uri.getAuthority();
+ // Strip credentials if present (e.g., user:[email protected])
+ if (host.contains("@")) {
+ host = host.substring(host.lastIndexOf("@") + 1);
+ }
+
+ if (host.startsWith("[")) {
+ int closeBracket = host.indexOf("]");
+ int portColon = host.indexOf(":", closeBracket);
+ if (portColon > -1) {
+ host = host.substring(0, portColon);
+ }
+ } else if (host.contains(":")) {
+ host = host.substring(0, host.indexOf(":"));
+ }
+ }
+
+ return host != null ? host.replaceAll("^\\[|\\]$", "") : null;
+ } catch (Exception e) {
+ LOG.debug("Failed to extract host from string: {}", urlString, e);
+ return null;
+ }
+ }
+
+ private static boolean isBlockedHost(String host) {
+ if (host == null || host.trim().isEmpty()) {
+ return false;
+ }
+ host = host.trim().toLowerCase();
+
+ // Expand POSIX shorthand IPs (e.g., 127.1 -> 127.0.0.1)
+ String normalizedIP = normalizePOSIXIp(host);
+ if (normalizedIP != null) {
+ host = normalizedIP;
+ }
+
try {
- return new URL(urlString);
+ InetAddress addr = InetAddress.getByName(host);
+
+ return addr.isLoopbackAddress() || addr.isLinkLocalAddress() ||
addr.isAnyLocalAddress() || "localhost".equals(host);
+ } catch (UnknownHostException e) {
Review Comment:
On UnknownHostException, isBlockedHost returns false, so validation does not
block that value at line 212(from called location)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
