You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by ma...@apache.org on 2022/11/12 21:00:05 UTC
[ranger] branch ranger-2.4 updated: RANGER-3959: restrict scripts from accessing some built-in methods - #2
This is an automated email from the ASF dual-hosted git repository.
madhan pushed a commit to branch ranger-2.4
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/ranger-2.4 by this push:
new d7ebfda84 RANGER-3959: restrict scripts from accessing some built-in methods - #2
d7ebfda84 is described below
commit d7ebfda8452901472e21fb9e118e4e61ea4c968e
Author: Madhan Neethiraj <ma...@apache.org>
AuthorDate: Tue Nov 8 17:31:30 2022 -0800
RANGER-3959: restrict scripts from accessing some built-in methods - #2
Signed-off-by: Abhay Kulkarni <ab...@apache.org>
(cherry picked from commit 161d924759936c029e4ada7c91e05b17fee7871b)
---
.../plugin/policyengine/RangerRequestScriptEvaluator.java | 3 +++
.../java/org/apache/ranger/plugin/util/ScriptEngineUtil.java | 10 +++++-----
2 files changed, 8 insertions(+), 5 deletions(-)
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerRequestScriptEvaluator.java b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerRequestScriptEvaluator.java
index 1ea01f2b8..b72162ab4 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerRequestScriptEvaluator.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerRequestScriptEvaluator.java
@@ -66,6 +66,7 @@ public final class RangerRequestScriptEvaluator {
private static final String DEFAULT_RANGER_TAG_ATTRIBUTE_DATE_FORMAT = "yyyy/MM/dd";
private static final String DEFAULT_ATLAS_TAG_ATTRIBUTE_DATE_FORMAT_NAME = "ATLAS_DATE_FORMAT";
private static final String DEFAULT_ATLAS_TAG_ATTRIBUTE_DATE_FORMAT = "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'";
+ private static final String SCRIPT_SAFE_PREEXEC = "exit=null;quit=null;";
private static final String SCRIPT_PREEXEC = SCRIPT_VAR__CTX + "=JSON.parse(" + SCRIPT_VAR__CTX_JSON + "); J=JSON.stringify;" +
SCRIPT_VAR_REQ + "=" + SCRIPT_VAR__CTX + "." + SCRIPT_FIELD_REQUEST + ";" +
SCRIPT_VAR_RES + "=" + SCRIPT_VAR_REQ + "." + SCRIPT_FIELD_RESOURCE + ";" +
@@ -225,6 +226,8 @@ public final class RangerRequestScriptEvaluator {
bindings.put(SCRIPT_VAR_tag, currentTag);
bindings.put(SCRIPT_VAR_tagAttr, tagAttribs);
+ script = SCRIPT_SAFE_PREEXEC + script;
+
if (enableJsonCtx) {
bindings.put(SCRIPT_VAR__CTX_JSON, this.toJson());
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/util/ScriptEngineUtil.java b/agents-common/src/main/java/org/apache/ranger/plugin/util/ScriptEngineUtil.java
index 7ae2ea766..22617f8b2 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/util/ScriptEngineUtil.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/util/ScriptEngineUtil.java
@@ -32,7 +32,7 @@ import jdk.nashorn.api.scripting.NashornScriptEngineFactory;
public class ScriptEngineUtil {
private static final Logger LOG = LoggerFactory.getLogger(RangerScriptConditionEvaluator.class);
- private static final String[] SCRIPT_ENGINE_ARGS = new String[0];
+ private static final String[] SCRIPT_ENGINE_ARGS = new String[] { "--no-java", "--no-syntax-extensions" };
// for backward compatibility with any plugin that might use this API
public static ScriptEngine createScriptEngine(String engineName, String serviceType) {
@@ -86,11 +86,11 @@ public class ScriptEngineUtil {
try {
final NashornScriptEngineFactory factory = new NashornScriptEngineFactory();
- if (clsLoader != null) {
- ret = factory.getScriptEngine(SCRIPT_ENGINE_ARGS, clsLoader, RangerClassFilter.INSTANCE);
- } else {
- ret = factory.getScriptEngine(RangerClassFilter.INSTANCE);
+ if (clsLoader == null) {
+ clsLoader = Thread.currentThread().getContextClassLoader();
}
+
+ ret = factory.getScriptEngine(SCRIPT_ENGINE_ARGS, clsLoader, RangerClassFilter.INSTANCE);
} catch (Throwable t) {
if (LOG.isDebugEnabled()) {
LOG.debug("ScriptEngineUtil.getScriptEngine(clsLoader={}): failed", clsLoader, t);