[jira] [Resolved] (RANGER-5708) Correct early publication of KnoxRangerPlugin in RangerPDPKnoxFilter

["Rohit Gupta (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/RANGER-5708?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Rohit Gupta resolved RANGER-5708.
---------------------------------
    Resolution: Fixed

> Correct early publication of KnoxRangerPlugin in RangerPDPKnoxFilter
> --------------------------------------------------------------------
>
>                 Key: RANGER-5708
>                 URL: https://issues.apache.org/jira/browse/RANGER-5708
>             Project: Ranger
>          Issue Type: Bug
>          Components: Ranger
>    Affects Versions: 3.0.0
>            Reporter: Rohit Gupta
>            Assignee: Rohit Gupta
>            Priority: Major
>             Fix For: 3.0.0
>
>          Time Spent: 20m
>  Remaining Estimate: 0h
>
> We have a concurrency issue in knox-agent RangerPDPKnoxFilter.init().
> The static {{plugin}} field is published before it is initialized, and this can cause some concurrent requests to be forbidden. Multiple Knox topologies or multiple initial requests to the same Knox topology can create separate RangerPDPKnoxFilter instances. Some threads can see a non-null but still uninitialized {{KnoxRangerPlugin}} with a null policyEngine. The filter in this case would send a 403 response.
> Please correct the early publication of the plugin field in RangerPDPKnoxFilter.init()



--
This message was sent by Atlassian Jira
(v8.20.10#820010)