You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by ma...@apache.org on 2022/10/20 17:19:29 UTC
[ranger] branch ranger-2.4 updated: RANGER-3953: fix potential NPE during policy-engine initialization
This is an automated email from the ASF dual-hosted git repository.
madhan pushed a commit to branch ranger-2.4
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/ranger-2.4 by this push:
new e61beecdf RANGER-3953: fix potential NPE during policy-engine initialization
e61beecdf is described below
commit e61beecdfb2fb1f27bd38ceacf3b268bb7c76b50
Author: Madhan Neethiraj <ma...@apache.org>
AuthorDate: Wed Oct 19 18:51:23 2022 -0700
RANGER-3953: fix potential NPE during policy-engine initialization
(cherry picked from commit e35fe23f72b2f7b86cf142859901d15bdc18103c)
---
.../policyengine/RangerRequestScriptEvaluator.java | 24 ++++++---
.../resourcematcher/RangerURLResourceMatcher.java | 15 ++++--
.../apache/ranger/plugin/util/MacroProcessor.java | 43 ++++++++--------
.../plugin/util/RangerRequestExprResolver.java | 59 ++++++++++++++--------
.../java/org/apache/ranger/common/StringUtil.java | 21 +++++---
5 files changed, 101 insertions(+), 61 deletions(-)
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerRequestScriptEvaluator.java b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerRequestScriptEvaluator.java
index ac0ad62d1..ab5dff336 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerRequestScriptEvaluator.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerRequestScriptEvaluator.java
@@ -128,25 +128,37 @@ public final class RangerRequestScriptEvaluator {
public static boolean needsJsonCtxEnabled(String script) {
- Matcher matcher = JSON_VAR_NAMES_PATTERN.matcher(script);
+ boolean ret = false;
+
+ if (script != null) {
+ Matcher matcher = JSON_VAR_NAMES_PATTERN.matcher(script);
- boolean ret = matcher.find();
+ ret = matcher.find();
+ }
return ret;
}
public static boolean hasUserAttributeReference(String script) {
- Matcher matcher = USER_ATTRIBUTES_PATTERN.matcher(script);
+ boolean ret = false;
- boolean ret = matcher.find();
+ if (script != null) {
+ Matcher matcher = USER_ATTRIBUTES_PATTERN.matcher(script);
+
+ ret = matcher.find();
+ }
return ret;
}
public static boolean hasGroupAttributeReference(String script) {
- Matcher matcher = GROUP_ATTRIBUTES_PATTERN.matcher(script);
+ boolean ret = false;
- boolean ret = matcher.find();
+ if (script != null) {
+ Matcher matcher = GROUP_ATTRIBUTES_PATTERN.matcher(script);
+
+ ret = matcher.find();
+ }
return ret;
}
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerURLResourceMatcher.java b/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerURLResourceMatcher.java
index 07a0d1c83..3e5da132f 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerURLResourceMatcher.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerURLResourceMatcher.java
@@ -209,14 +209,19 @@ public class RangerURLResourceMatcher extends RangerDefaultResourceMatcher {
}
static boolean isPathURLType(String url) {
+ boolean ret = false;
+
+ if (url != null) {
+ Pattern p1 = Pattern.compile(":/{2}");
+ Matcher m1 = p1.matcher(url);
- Pattern p1 = Pattern.compile(":/{2}");
- Matcher m1 = p1.matcher(url);
+ Pattern p2 = Pattern.compile(":/{3,}");
+ Matcher m2 = p2.matcher(url);
- Pattern p2 = Pattern.compile(":/{3,}");
- Matcher m2 = p2.matcher(url);
+ ret = (m1.find() && !(m2.find()));
+ }
- return (m1.find() && !(m2.find()));
+ return ret;
}
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/util/MacroProcessor.java b/agents-common/src/main/java/org/apache/ranger/plugin/util/MacroProcessor.java
index 77091332c..8332cd93a 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/util/MacroProcessor.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/util/MacroProcessor.java
@@ -38,35 +38,36 @@ public class MacroProcessor {
}
public String expandMacros(String expr) {
- StringBuffer ret = null;
- Matcher matcher = macrosPattern.matcher(expr);
+ StringBuffer ret = null;
- while (matcher.find()) {
- if (ret == null) {
- ret = new StringBuffer();
- }
+ if (expr != null) {
+ Matcher matcher = macrosPattern.matcher(expr);
- String keyword = matcher.group();
- String replacer = macrosMap.get(keyword);
+ while (matcher.find()) {
+ if (ret == null) {
+ ret = new StringBuffer();
+ }
- matcher.appendReplacement(ret, replacer);
- }
+ String keyword = matcher.group();
+ String replacer = macrosMap.get(keyword);
- if (ret == null) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("expandMacros({}): no match found!", expr);
+ matcher.appendReplacement(ret, replacer);
}
- return expr;
- } else {
- matcher.appendTail(ret);
-
- if (LOG.isDebugEnabled()) {
- LOG.debug("expandMacros({}): match found. ret={}", expr, ret);
+ if (ret == null) {
+ if (LOG.isDebugEnabled()) {
+ LOG.debug("expandMacros({}): no match found!", expr);
+ }
+ } else {
+ matcher.appendTail(ret);
+
+ if (LOG.isDebugEnabled()) {
+ LOG.debug("expandMacros({}): match found. ret={}", expr, ret);
+ }
}
-
- return ret.toString();
}
+
+ return ret != null ? ret.toString() : expr;
}
private Pattern getMacrosPattern(Map<String, String> macros) {
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerRequestExprResolver.java b/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerRequestExprResolver.java
index 3a183cff6..a78af75b8 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerRequestExprResolver.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerRequestExprResolver.java
@@ -124,22 +124,31 @@ public class RangerRequestExprResolver {
}
public static boolean hasExpressions(String str) {
- Matcher matcher = PATTERN.matcher(str);
+ boolean ret = false;
+
+ if (str != null) {
+ Matcher matcher = PATTERN.matcher(str);
+
+ ret = matcher.find();
+ }
- return matcher.find();
+ return ret;
}
public static boolean hasUserAttributeInExpression(String str) {
boolean ret = false;
- Matcher matcher = PATTERN.matcher(str);
- while (matcher.find()) {
- String expr = matcher.group(REGEX_GROUP_EXPR);
+ if (str != null) {
+ Matcher matcher = PATTERN.matcher(str);
- if (RangerRequestScriptEvaluator.hasUserAttributeReference(expr)) {
- ret = true;
+ while (matcher.find()) {
+ String expr = matcher.group(REGEX_GROUP_EXPR);
- break;
+ if (RangerRequestScriptEvaluator.hasUserAttributeReference(expr)) {
+ ret = true;
+
+ break;
+ }
}
}
@@ -147,16 +156,19 @@ public class RangerRequestExprResolver {
}
public static boolean hasGroupAttributeInExpression(String str) {
- boolean ret = false;
- Matcher matcher = PATTERN.matcher(str);
+ boolean ret = false;
- while (matcher.find()) {
- String expr = matcher.group(REGEX_GROUP_EXPR);
+ if (str != null) {
+ Matcher matcher = PATTERN.matcher(str);
- if (RangerRequestScriptEvaluator.hasGroupAttributeReference(expr)) {
- ret = true;
+ while (matcher.find()) {
+ String expr = matcher.group(REGEX_GROUP_EXPR);
+
+ if (RangerRequestScriptEvaluator.hasGroupAttributeReference(expr)) {
+ ret = true;
- break;
+ break;
+ }
}
}
@@ -164,16 +176,19 @@ public class RangerRequestExprResolver {
}
public static boolean hasUserGroupAttributeInExpression(String str) {
- boolean ret = false;
- Matcher matcher = PATTERN.matcher(str);
+ boolean ret = false;
- while (matcher.find()) {
- String expr = matcher.group(REGEX_GROUP_EXPR);
+ if (str != null) {
+ Matcher matcher = PATTERN.matcher(str);
- if (RangerRequestScriptEvaluator.hasUserGroupAttributeReference(expr)) {
- ret = true;
+ while (matcher.find()) {
+ String expr = matcher.group(REGEX_GROUP_EXPR);
+
+ if (RangerRequestScriptEvaluator.hasUserGroupAttributeReference(expr)) {
+ ret = true;
- break;
+ break;
+ }
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java b/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java
index ed2e8df77..275c883c5 100644
--- a/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java
+++ b/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java
@@ -150,14 +150,21 @@ public class StringUtil implements Serializable {
}
public boolean regExPatternMatch(String expression, String inputStr) {
- Pattern pattern = compiledRegEx.get(expression);
- if (pattern == null) {
- pattern = Pattern.compile(expression, Pattern.CASE_INSENSITIVE);
- compiledRegEx.put(expression, pattern);
+ boolean ret = false;
+
+ if (expression != null && inputStr != null) {
+ Pattern pattern = compiledRegEx.get(expression);
+
+ if (pattern == null) {
+ pattern = Pattern.compile(expression, Pattern.CASE_INSENSITIVE);
+ compiledRegEx.put(expression, pattern);
+ }
+
+ Matcher matcher = pattern.matcher(inputStr);
+ ret = matcher.matches();
}
- Matcher matcher = pattern.matcher(inputStr);
- return matcher.matches();
+ return ret;
}
public boolean validateString(String regExStr, String str) {
@@ -205,7 +212,7 @@ public class StringUtil implements Serializable {
}
/**
- * @param firstName
+ * @param name
* @return
*/
public boolean isValidName(String name) {