You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by Don Bosco Durai <bo...@apache.org> on 2017/07/27 11:41:54 UTC
FW: New Defects reported by Coverity Scan for Apache Ranger
Please review and fix.
Thanks
Bosco
On 7/27/17, 1:45 AM, "scan-admin@coverity.com" <sc...@coverity.com> wrote:
Hi,
Please find the latest report on new defect(s) introduced to Apache Ranger found with Coverity Scan.
2 new defect(s) introduced to Apache Ranger found with Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 2 of 2 defect(s)
** CID 166074: Null pointer dereferences (NULL_RETURNS)
/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java: 1474 in org.apache.ranger.authorization.hive.authorizer.RangerHiveAuthorizer.showPrivileges(org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrincipal, org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject)()
________________________________________________________________________________________________________
*** CID 166074: Null pointer dereferences (NULL_RETURNS)
/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java: 1474 in org.apache.ranger.authorization.hive.authorizer.RangerHiveAuthorizer.showPrivileges(org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrincipal, org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject)()
1468 .getType());
1469
1470 List<HiveObjectPrivilege> msObjPrivs = mClient.list_privileges(
1471 principalName, principalType,
1472 this.getThriftHiveObjectRef(privObj));
1473
>>> CID 166074: Null pointer dereferences (NULL_RETURNS)
>>> Calling a method on null object "msObjPrivs".
1474 for (HiveObjectPrivilege msObjPriv : msObjPrivs) {
1475 HivePrincipal resPrincipal = new HivePrincipal(
1476 msObjPriv.getPrincipalName(),
1477 AuthorizationUtils.getHivePrincipalType(msObjPriv
1478 .getPrincipalType()));
1479
** CID 166073: FindBugs: Bad practice (FB.DMI_RANDOM_USED_ONLY_ONCE)
/hdfs-agent/src/main/java/org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java: 601 in org.apache.ranger.authorization.hadoop.RangerHdfsPlugin.init()()
________________________________________________________________________________________________________
*** CID 166073: FindBugs: Bad practice (FB.DMI_RANDOM_USED_ONLY_ONCE)
/hdfs-agent/src/main/java/org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java: 601 in org.apache.ranger.authorization.hadoop.RangerHdfsPlugin.init()()
595 RangerHdfsPlugin.hadoopAuthEnabled = RangerConfiguration.getInstance().getBoolean(RangerHadoopConstants.RANGER_ADD_HDFS_PERMISSION_PROP, RangerHadoopConstants.RANGER_ADD_HDFS_PERMISSION_DEFAULT);
596 RangerHdfsPlugin.fileNameExtensionSeparator = RangerConfiguration.getInstance().get(RangerHdfsAuthorizer.RANGER_FILENAME_EXTENSION_SEPARATOR_PROP, RangerHdfsAuthorizer.DEFAULT_FILENAME_EXTENSION_SEPARATOR);
597 RangerHdfsPlugin.optimizeSubAccessAuthEnabled = RangerConfiguration.getInstance().getBoolean(RangerHadoopConstants.RANGER_OPTIMIZE_SUBACCESS_AUTHORIZATION_PROP, RangerHadoopConstants.RANGER_OPTIMIZE_SUBACCESS_AUTHORIZATION_DEFAULT);
598
599 // Build random string of random length
600 byte[] bytes = new byte[1];
>>> CID 166073: FindBugs: Bad practice (FB.DMI_RANDOM_USED_ONLY_ONCE)
>>> Random object created and used only once.
601 new Random().nextBytes(bytes);
602 int count = bytes[0];
603 count = count < 56 ? 56 : count;
604 count = count > 112 ? 112 : count;
605
606 String random = RandomStringUtils.random(count, "^&#@!%()-_+=@:;'<>`~abcdefghijklmnopqrstuvwxyz01234567890");
________________________________________________________________________________________________________
FW: FW: New Defects reported by Coverity Scan for Apache Ranger
Posted by pe...@zte.com.cn.
T2suIFRoYW5rcy4NCg0KDQoNCg0KDQoNCg0KDQoNCg0KSmlhbmh1YSBQZW5nDQoNCg0KDQoNCg0K
DQoNCg0KDQoNCg0KDQoNCg0KRlc6IE5ldyBEZWZlY3RzIHJlcG9ydGVkIGJ5IENvdmVyaXR5IFNj
YW4gZm9yIEFwYWNoZSBSYW5nZXINCg0KDQoNCg0KDQpQbGVhc2UgcmV2aWV3IGFuZCBmaXguIA0K
DQpUaGFua3MNCg0KQm9zY28NCg0KDQpPbiA3LzI3LzE3LCAxOjQ1IEFNLCAic2Nhbi1hZG1pbkBj
b3Zlcml0eS5jb20iIDxzY2FuLWFkbWluQGNvdmVyaXR5LmNvbT4gd3JvdGU6DQoNCiAgICANCiAg
ICBIaSwNCiAgICANCiAgICBQbGVhc2UgZmluZCB0aGUgbGF0ZXN0IHJlcG9ydCBvbiBuZXcgZGVm
ZWN0KHMpIGludHJvZHVjZWQgdG8gQXBhY2hlIFJhbmdlciBmb3VuZCB3aXRoIENvdmVyaXR5IFNj
YW4uDQogICAgDQogICAgMiBuZXcgZGVmZWN0KHMpIGludHJvZHVjZWQgdG8gQXBhY2hlIFJhbmdl
ciBmb3VuZCB3aXRoIENvdmVyaXR5IFNjYW4uDQogICAgDQogICAgDQogICAgTmV3IGRlZmVjdChz
KSBSZXBvcnRlZC1ieTogQ292ZXJpdHkgU2Nhbg0KICAgIFNob3dpbmcgMiBvZiAyIGRlZmVjdChz
KQ0KICAgIA0KICAgIA0KICAgICoqIENJRCAxNjYwNzQ6ICBOdWxsIHBvaW50ZXIgZGVyZWZlcmVu
Y2VzICAoTlVMTF9SRVRVUk5TKQ0KICAgIC9oaXZlLWFnZW50L3NyYy9tYWluL2phdmEvb3JnL2Fw
YWNoZS9yYW5nZXIvYXV0aG9yaXphdGlvbi9oaXZlL2F1dGhvcml6ZXIvUmFuZ2VySGl2ZUF1dGhv
cml6ZXIuamF2YTogMTQ3NCBpbiBvcmcuYXBhY2hlLnJhbmdlci5hdXRob3JpemF0aW9uLmhpdmUu
YXV0aG9yaXplci5SYW5nZXJIaXZlQXV0aG9yaXplci5zaG93UHJpdmlsZWdlcyhvcmcuYXBhY2hl
LmhhZG9vcC5oaXZlLnFsLnNlY3VyaXR5LmF1dGhvcml6YXRpb24ucGx1Z2luLkhpdmVQcmluY2lw
YWwsIG9yZy5hcGFjaGUuaGFkb29wLmhpdmUucWwuc2VjdXJpdHkuYXV0aG9yaXphdGlvbi5wbHVn
aW4uSGl2ZVByaXZpbGVnZU9iamVjdCkoKQ0KICAgIA0KICAgIA0KICAgIF9fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQogICAgKioqIENJRCAxNjYwNzQ6ICBO
dWxsIHBvaW50ZXIgZGVyZWZlcmVuY2VzICAoTlVMTF9SRVRVUk5TKQ0KICAgIC9oaXZlLWFnZW50
L3NyYy9tYWluL2phdmEvb3JnL2FwYWNoZS9yYW5nZXIvYXV0aG9yaXphdGlvbi9oaXZlL2F1dGhv
cml6ZXIvUmFuZ2VySGl2ZUF1dGhvcml6ZXIuamF2YTogMTQ3NCBpbiBvcmcuYXBhY2hlLnJhbmdl
ci5hdXRob3JpemF0aW9uLmhpdmUuYXV0aG9yaXplci5SYW5nZXJIaXZlQXV0aG9yaXplci5zaG93
UHJpdmlsZWdlcyhvcmcuYXBhY2hlLmhhZG9vcC5oaXZlLnFsLnNlY3VyaXR5LmF1dGhvcml6YXRp
b24ucGx1Z2luLkhpdmVQcmluY2lwYWwsIG9yZy5hcGFjaGUuaGFkb29wLmhpdmUucWwuc2VjdXJp
dHkuYXV0aG9yaXphdGlvbi5wbHVnaW4uSGl2ZVByaXZpbGVnZU9iamVjdCkoKQ0KICAgIDE0Njgg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAuZ2V0VHlwZSgpKQ0KICAgIDE0NjkgICAg
IA0KICAgIDE0NzAgICAgICAgICAgICAgICAgIExpc3Q8SGl2ZU9iamVjdFByaXZpbGVnZT4gbXNP
YmpQcml2cyA9IG1DbGllbnQubGlzdF9wcml2aWxlZ2VzKA0KICAgIDE0NzEgICAgICAgICAgICAg
ICAgICAgICAgICAgcHJpbmNpcGFsTmFtZSwgcHJpbmNpcGFsVHlwZSwNCiAgICAxNDcyICAgICAg
ICAgICAgICAgICAgICAgICAgIHRoaXMuZ2V0VGhyaWZ0SGl2ZU9iamVjdFJlZihwcml2T2JqKSkN
CiAgICAxNDczICAgICANCiAgICA+Pj4gICAgIENJRCAxNjYwNzQ6ICBOdWxsIHBvaW50ZXIgZGVy
ZWZlcmVuY2VzICAoTlVMTF9SRVRVUk5TKQ0KICAgID4+PiAgICAgQ2FsbGluZyBhIG1ldGhvZCBv
biBudWxsIG9iamVjdCAibXNPYmpQcml2cyIuDQogICAgMTQ3NCAgICAgICAgICAgICAgICAgZm9y
IChIaXZlT2JqZWN0UHJpdmlsZWdlIG1zT2JqUHJpdiA6IG1zT2JqUHJpdnMpIHsNCiAgICAxNDc1
ICAgICAgICAgICAgICAgICAgICAgSGl2ZVByaW5jaXBhbCByZXNQcmluY2lwYWwgPSBuZXcgSGl2
ZVByaW5jaXBhbCgNCiAgICAxNDc2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtc09ialBy
aXYuZ2V0UHJpbmNpcGFsTmFtZSgpLA0KICAgIDE0NzcgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIEF1dGhvcml6YXRpb25VdGlscy5nZXRIaXZlUHJpbmNpcGFsVHlwZShtc09ialByaXYNCiAg
ICAxNDc4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC5nZXRQcmluY2lwYWxU
eXBlKCkpKQ0KICAgIDE0NzkgICAgIA0KICAgIA0KICAgICoqIENJRCAxNjYwNzM6ICBGaW5kQnVn
czogQmFkIHByYWN0aWNlICAoRkIuRE1JX1JBTkRPTV9VU0VEX09OTFlfT05DRSkNCiAgICAvaGRm
cy1hZ2VudC9zcmMvbWFpbi9qYXZhL29yZy9hcGFjaGUvcmFuZ2VyL2F1dGhvcml6YXRpb24vaGFk
b29wL1JhbmdlckhkZnNBdXRob3JpemVyLmphdmE6IDYwMSBpbiBvcmcuYXBhY2hlLnJhbmdlci5h
dXRob3JpemF0aW9uLmhhZG9vcC5SYW5nZXJIZGZzUGx1Z2luLmluaXQoKSgpDQogICAgDQogICAg
DQogICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCiAg
ICAqKiogQ0lEIDE2NjA3MzogIEZpbmRCdWdzOiBCYWQgcHJhY3RpY2UgIChGQi5ETUlfUkFORE9N
X1VTRURfT05MWV9PTkNFKQ0KICAgIC9oZGZzLWFnZW50L3NyYy9tYWluL2phdmEvb3JnL2FwYWNo
ZS9yYW5nZXIvYXV0aG9yaXphdGlvbi9oYWRvb3AvUmFuZ2VySGRmc0F1dGhvcml6ZXIuamF2YTog
NjAxIGluIG9yZy5hcGFjaGUucmFuZ2VyLmF1dGhvcml6YXRpb24uaGFkb29wLlJhbmdlckhkZnNQ
bHVnaW4uaW5pdCgpKCkNCiAgICA1OTUgICAgICAgICAgICAgUmFuZ2VySGRmc1BsdWdpbi5oYWRv
b3BBdXRoRW5hYmxlZCA9IFJhbmdlckNvbmZpZ3VyYXRpb24uZ2V0SW5zdGFuY2UoKS5nZXRCb29s
ZWFuKFJhbmdlckhhZG9vcENvbnN0YW50cy5SQU5HRVJfQUREX0hERlNfUEVSTUlTU0lPTl9QUk9Q
LCBSYW5nZXJIYWRvb3BDb25zdGFudHMuUkFOR0VSX0FERF9IREZTX1BFUk1JU1NJT05fREVGQVVM
VCkNCiAgICA1OTYgICAgICAgICAgICAgUmFuZ2VySGRmc1BsdWdpbi5maWxlTmFtZUV4dGVuc2lv
blNlcGFyYXRvciA9IFJhbmdlckNvbmZpZ3VyYXRpb24uZ2V0SW5zdGFuY2UoKS5nZXQoUmFuZ2Vy
SGRmc0F1dGhvcml6ZXIuUkFOR0VSX0ZJTEVOQU1FX0VYVEVOU0lPTl9TRVBBUkFUT1JfUFJPUCwg
UmFuZ2VySGRmc0F1dGhvcml6ZXIuREVGQVVMVF9GSUxFTkFNRV9FWFRFTlNJT05fU0VQQVJBVE9S
KQ0KICAgIDU5NyAgICAgICAgICAgICBSYW5nZXJIZGZzUGx1Z2luLm9wdGltaXplU3ViQWNjZXNz
QXV0aEVuYWJsZWQgPSBSYW5nZXJDb25maWd1cmF0aW9uLmdldEluc3RhbmNlKCkuZ2V0Qm9vbGVh
bihSYW5nZXJIYWRvb3BDb25zdGFudHMuUkFOR0VSX09QVElNSVpFX1NVQkFDQ0VTU19BVVRIT1JJ
WkFUSU9OX1BST1AsIFJhbmdlckhhZG9vcENvbnN0YW50cy5SQU5HRVJfT1BUSU1JWkVfU1VCQUND
RVNTX0FVVEhPUklaQVRJT05fREVGQVVMVCkNCiAgICA1OTggICAgIA0KICAgIDU5OSAgICAgICAg
ICAgICAvLyBCdWlsZCByYW5kb20gc3RyaW5nIG9mIHJhbmRvbSBsZW5ndGgNCiAgICA2MDAgICAg
ICAgICAgICAgYnl0ZVtdIGJ5dGVzID0gbmV3IGJ5dGVbMV0NCiAgICA+Pj4gICAgIENJRCAxNjYw
NzM6ICBGaW5kQnVnczogQmFkIHByYWN0aWNlICAoRkIuRE1JX1JBTkRPTV9VU0VEX09OTFlfT05D
RSkNCiAgICA+Pj4gICAgIFJhbmRvbSBvYmplY3QgY3JlYXRlZCBhbmQgdXNlZCBvbmx5IG9uY2Uu
DQogICAgNjAxICAgICAgICAgICAgIG5ldyBSYW5kb20oKS5uZXh0Qnl0ZXMoYnl0ZXMpDQogICAg
NjAyICAgICAgICAgICAgIGludCBjb3VudCA9IGJ5dGVzWzBdDQogICAgNjAzICAgICAgICAgICAg
IGNvdW50ID0gY291bnQgPCA1NiA/IDU2IDogY291bnQNCiAgICA2MDQgICAgICAgICAgICAgY291
bnQgPSBjb3VudCA+IDExMiA/IDExMiA6IGNvdW50DQogICAgNjA1ICAgICANCiAgICA2MDYgICAg
ICAgICAgICAgU3RyaW5nIHJhbmRvbSA9IFJhbmRvbVN0cmluZ1V0aWxzLnJhbmRvbShjb3VudCwg
Il5AISUoKS1fKz1AOic8PmB+YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU2Nzg5MCIp
DQogICAgDQogICAgDQogICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX18=