[jira] [Comment Edited] (OAK-8000) AccessControlManagerImpl.getEffectivePolicies(String) doesn't respect restrictions

["angela (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/OAK-8000?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16766106#comment-16766106 ] 

angela edited comment on OAK-8000 at 2/12/19 4:13 PM:
------------------------------------------------------

[~stillalex], also i noticed while working on this the getEffectivePolicies methods may returns empty ACLs, which doesn't make too much sense IMO. I would refactor that part out and report it with a separate issue. (OAK-8044)


was (Author: anchela):
[~stillalex], also i noticed while working on this the getEffectivePolicies methods may returns empty ACLs, which doesn't make too much sense IMO. I would refactor that part out and report it with a separate issue.

> AccessControlManagerImpl.getEffectivePolicies(String) doesn't respect restrictions
> ----------------------------------------------------------------------------------
>
>                 Key: OAK-8000
>                 URL: https://issues.apache.org/jira/browse/OAK-8000
>             Project: Jackrabbit Oak
>          Issue Type: Bug
>          Components: core, security
>            Reporter: angela
>            Assignee: angela
>            Priority: Minor
>         Attachments: OAK-8000-test.patch, OAK-8000.patch
>
>
> [~stillalex], looking at the implementation of {{AccessControlManagerImpl.getEffectivePolicies(String)}} I noticed that the implementation only walks up the hierarchy collection the access control lists but does not evaluated whether the individual entries actually take effect on the tree defined by the 'absPath' param. While this is always true for entries without restrictions, it doesn't necessarily apply for entries that hold restrictions.
> The easiest way to fix this was probably to call the variant of {{createACL}} that takes a {{Predicate}} and use that one to read and evaluate the restriction pattern present with each entry tree. 
> Since the {{AccessControlManager.getEffectivePolicies}} is defined to be best-effort, I don't consider this a serious flaw. But for the sake of improved accuracy it might still be worth addressing. wdyt?



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)