Copilot commented on code in PR #1302:
URL: https://github.com/apache/ranger/pull/1302#discussion_r4226668321
##########
agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerRequestScriptEvaluator.java:
##########
@@ -915,7 +918,7 @@ private String toJson() {
request.put(SCRIPT_FIELD_USER_GROUP_ATTRIBUTES, groupAttrs);
request.put(SCRIPT_FIELD_UGA, new UserGroupsAttributes(userGroups,
groupAttrs).getAttributes());
-
+ request.put(SCRIPT_FIELD_CTX_ATTR,
RangerAccessRequestUtil.cloneWithNoInternalKeys(getRequestContext()));
Review Comment:
`RangerAccessRequest.getContext()` permits arbitrary `Object` values, so
adding the entire application context to the JSON payload makes every
JSON-backed expression depend on every value being Jackson-serializable. A
cyclic map or unsupported object makes `JsonUtils.objectToJson()` return
`null`; the constructor's pre-exec then cannot initialize `REQ`/`CTX_ATTR`, and
the condition falls back to `false`. Normalize or validate each exposed value
(or omit/reject unsupported attributes independently) so one unrelated
attribute cannot disable policy expression evaluation, and cover this with a
regression test.
##########
agents-common/src/test/java/org/apache/ranger/plugin/conditionevaluator/RangerRequestScriptEvaluatorTest.java:
##########
@@ -605,6 +605,46 @@ void testBlockJavaClassReferencesWithDefaultConfig() {
Assertions.assertTrue(escaped.isEmpty(), "Sandbox escape OS command
executed via:\n " + String.join("\n ", escaped));
}
+ @Test
+ public void testContextAttributes() {
+ Map<String, Object> attributes = new HashMap<>();
+
+ attributes.put("trx_amount", 10000);
+
+ RangerAccessRequest request = createRequest("test-user",
Collections.emptySet(), Collections.emptySet(), attributes);
+ RangerRequestScriptEvaluator evaluator = new
RangerRequestScriptEvaluator(request, scriptEngine);
+
+ // trx_amount=10,000; test if less-than-or-equals 10,000 => false
Review Comment:
The comment states that the less-than-or-equal comparison is false, but
`10,000 <= 10,000` and the assertion below are true.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
