[jira] [Created] (RANGER-5850) Validate nested role membership for cycles and avoid recursive role expansion in RoleREST

["Vyom Mani Tiwari (Jira)" <ji...@apache.org>]

Vyom Mani Tiwari created RANGER-5850:
----------------------------------------

             Summary: Validate nested role membership for cycles and avoid recursive role expansion in RoleREST
                 Key: RANGER-5850
                 URL: https://issues.apache.org/jira/browse/RANGER-5850
             Project: Ranger
          Issue Type: Bug
          Components: Ranger
    Affects Versions: 2.9.0
            Reporter: Vyom Mani Tiwari
            Assignee: Vyom Mani Tiwari
             Fix For: 3.0.0


Ranger roles can contain other roles. Today the server doesn’t validate this nesting when a role is saved, so a role can end up containing itself, directly or through other roles. Paths that create, update, import or grant roles all accept such a configuration. One of them, granting a role into itself, isn’t caught by the existing check in {{{}addUsersGroupsAndRoles{}}}.

Several RoleREST helpers expand nested roles recursively without tracking which roles they’ve already visited. When the role graph contains a cycle, those requests fail instead of returning a result. The plugin-side {{RangerRolesUtil}} already handles this case safely.

Proposed changes:
 * Reject role create and update in {{RoleDBStore}} when the nested roles would make a role contain itself, directly or transitively, including on rename.
 * Reject granting a role into itself.
 * Make nested-role expansion in RoleREST iterative, with a visited set, so existing data with cycles is handled safely.
 * Add unit tests.

Note: after this change, updating a role that already sits in a nested-role cycle is rejected until the cycle is removed.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)