vyommani commented on code in PR #1266:
URL: https://github.com/apache/ranger/pull/1266#discussion_r4145914002
##########
security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java:
##########
@@ -460,6 +446,205 @@ Long parseLong(String str) {
}
}
+ private void enforceSavedServiceEndpointConfigs(RangerService service)
throws Exception {
+ if
(!Boolean.parseBoolean(PropertiesUtil.getProperty(PROP_SERVICE_CONFIG_VALIDATE_REQUIRE_SAVED_SERVICE,
"false"))) {
+ return;
+ }
+
+ String serviceName = service.getName();
+ if (StringUtils.isBlank(serviceName)) {
+ return;
+ }
+
+ RangerService savedService = svcDBStore.getServiceByName(serviceName);
+ if (savedService == null) {
+ throw new Exception("Configuration validation requires a saved
service: " + serviceName);
+ }
+
+ if (StringUtils.isNotBlank(service.getType()) &&
StringUtils.isNotBlank(savedService.getType())
+ && !StringUtils.equals(service.getType(),
savedService.getType())) {
+ throw new Exception("Configuration validation service type does
not match saved service: " + serviceName);
+ }
+
+ Map<String, String> savedConfigs =
rangerSvcService.getConfigsWithDecryptedPassword(savedService);
+ if (savedConfigs == null) {
+ savedConfigs = Collections.emptyMap();
+ }
+
+ for (Map.Entry<String, String> entry :
service.getConfigs().entrySet()) {
+ String configKey = entry.getKey();
+ String requestValue = entry.getValue();
+ if (requestValue == null || requestValue.trim().isEmpty()) {
+ continue;
+ }
+
+ if (!looksLikeConnectionUrl(requestValue)) {
Review Comment:
If the request value has no ://, this skips the pin even when the saved
value is a connection URL. A saved https://knox.example.com:8443/gateway still
accepts evil.example.com:8443, and the blocked-host check allows it because
that host is not loopback. The same check skips endpoint strings that never use
://, such as jdbc:oracle:thin:@host:1521:ORCL and zk1:2181,zk2:2181, so those
hosts can still be changed.
If either the saved value or the request value is a connection endpoint,
both should be required to match. A request value should not be skipped only
because it lacks :// when the saved value has one.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
