[
https://issues.apache.org/jira/browse/RANGER-5850?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18137784#comment-18137784
]
Dineshkumar Yadav commented on RANGER-5850:
-------------------------------------------
Ranger Master :
https://github.com/apache/ranger/commit/8ef86d1c37e2118071d1c507a61cee295b8ed8e4
Ranger-2.10 commit
:https://github.com/apache/ranger/commit/6e35c61708329ee3cad310abca1b2aca771ed0bd
> Validate nested role membership for cycles and avoid recursive role expansion
> in RoleREST
> -----------------------------------------------------------------------------------------
>
> Key: RANGER-5850
> URL: https://issues.apache.org/jira/browse/RANGER-5850
> Project: Ranger
> Issue Type: Bug
> Components: Ranger
> Affects Versions: 2.9.0
> Reporter: Vyom Mani Tiwari
> Assignee: Vyom Mani Tiwari
> Priority: Critical
> Fix For: 3.0.0
>
> Time Spent: 1h 20m
> Remaining Estimate: 0h
>
> Ranger roles can contain other roles. Today the server doesn’t validate this
> nesting when a role is saved, so a role can end up containing itself,
> directly or through other roles. Paths that create, update, import or grant
> roles all accept such a configuration. One of them, granting a role into
> itself, isn’t caught by the existing check in {{{}addUsersGroupsAndRoles{}}}.
> Several RoleREST helpers expand nested roles recursively without tracking
> which roles they’ve already visited. When the role graph contains a cycle,
> those requests fail instead of returning a result. The plugin-side
> {{RangerRolesUtil}} already handles this case safely.
> Proposed changes:
> * Reject role create and update in {{RoleDBStore}} when the nested roles
> would make a role contain itself, directly or transitively, including on
> rename.
> * Reject granting a role into itself.
> * Make nested-role expansion in RoleREST iterative, with a visited set, so
> existing data with cycles is handled safely.
> * Add unit tests.
> Note: after this change, updating a role that already sits in a nested-role
> cycle is rejected until the cycle is removed.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
