[
https://issues.apache.org/jira/browse/RANGER-5819?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18129407#comment-18129407
]
Vyom Mani Tiwari commented on RANGER-5819:
------------------------------------------
Backported to ranger-2.10 via PR #1285:
https://github.com/apache/ranger/pull/1285
Commit: 230b34e27 ("Make grant/revoke endpoint security patterns
slash-insensitive (follow-up to RANGER-5677) (#1285)")
The PR title and commit message don't include the RANGER-5819 key, so they
weren't linked here automatically.
This backport also includes the RANGER-5677 download-endpoint pattern changes,
so no separate RANGER-5677 backport is needed for 2.10. The
/service/gds/download pattern from RANGER-5677 is not applicable, as GDS is not
present in ranger-2.10.
> Make grant/revoke endpoint security patterns slash-insensitive (follow-up to
> RANGER-5677)
> -----------------------------------------------------------------------------------------
>
> Key: RANGER-5819
> URL: https://issues.apache.org/jira/browse/RANGER-5819
> Project: Ranger
> Issue Type: Improvement
> Components: Ranger
> Affects Versions: 2.8.0, 2.9.0
> Reporter: Vyom Mani Tiwari
> Assignee: Vyom Mani Tiwari
> Priority: Major
> Time Spent: 20m
> Remaining Estimate: 0h
>
> RANGER-5677 made the non-secure {{download}} endpoint URL patterns in
> {{security-applicationContext.xml}} slash-insensitive ({{{}/{*}{*}{}}} \{*}→
> {{/}}{*}{{{}**{}}}{*}) so that trailing-slash variants resolve to the same
> Spring Security rule. That change covered only the {{download/}}{*} endpoints.
> The {{{}grant{}}}/{{{}revoke{}}} endpoints still use single-segment {{*}}
> patterns and were not included:
>
> {{/service/plugins/services/grant/*
> /service/plugins/services/revoke/*
> /service/assets/resources/grant
> /service/assets/resources/revoke}}
> Because Jersey resolves a trailing slash to the same resource method
> (sub-resource methods are compiled with an optional {{?}} suffix) while the
> Spring Ant matcher {{*}} does not match the trailing-slash form, a request to
> these endpoints with a trailing slash is matched by a different filter chain
> than the canonical path. This inconsistency should be removed so all variants
> of these endpoints resolve to the same, intended rule, matching the treatment
> already applied to the download endpoints.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
