[jira] [Created] (RANGER-1198) REST API: 404 while retrieving and updating a policy with a slash in the name

["André Frimberger (JIRA)" <ji...@apache.org>]

André Frimberger created RANGER-1198:
----------------------------------------

             Summary: REST API: 404 while retrieving and updating a policy with a slash in the name
                 Key: RANGER-1198
                 URL: https://issues.apache.org/jira/browse/RANGER-1198
             Project: Ranger
          Issue Type: Bug
    Affects Versions: 0.6.1, 0.6.0, 0.7.0
            Reporter: André Frimberger


A policy, which is created via Ranger's admin UI can contain slashes, e.g. ("MyPolicy Read/Execute" or "/tmp/some/test"). However, updating or retrieving such a policy via the REST API _fails_ with a _Bad Request_ or _Not found_.

For retrieving ({{GET}}) and updating ({{PUT}}) a policy, its name is transferred as {{@PathParam}}:
{code}
@Path("/api/service/{servicename}/policy/{policyname}")
{code}

Obviously, {{@PathParam}} parameters shouldn't contain slashes, because they're interpreted as path separators. URL encoding {{policyname}} doesn't work (Bad Request is returned), either. Due to security implications (Directoy traversal attack - https://en.wikipedia.org/wiki/Directory_traversal_attack) Tomcat filters %2F from the URL path.

I suggest to pass {{servicename}} and {{policyname}} as "query" or in case of updating in the message body.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)