You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by "Vyom Mani Tiwari (Jira)" <ji...@apache.org> on 2026/10/05 05:19:00 UTC
[jira] [Updated] (RANGER-5819) Make grant/revoke endpoint security patterns slash-insensitive (follow-up to RANGER-5677)
[ https://issues.apache.org/jira/browse/RANGER-5819?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Vyom Mani Tiwari updated RANGER-5819:
-------------------------------------
Description:
RANGER-5677 made the non-secure {{download}} endpoint URL patterns in {{security-applicationContext.xml}} slash-insensitive ({{{}/{*}{*}{}}} \{*}→ {{/}}{*}{{{}**{}}}{*}) so that trailing-slash variants resolve to the same Spring Security rule. That change covered only the {{download/}}{*} endpoints.
The {{{}grant{}}}/{{{}revoke{}}} endpoints still use single-segment {{*}} patterns and were not included:
{{/service/plugins/services/grant/*
/service/plugins/services/revoke/*
/service/assets/resources/grant
/service/assets/resources/revoke}}
Because Jersey resolves a trailing slash to the same resource method (sub-resource methods are compiled with an optional {{?}} suffix) while the Spring Ant matcher {{*}} does not match the trailing-slash form, a request to these endpoints with a trailing slash is matched by a different filter chain than the canonical path. This inconsistency should be removed so all variants of these endpoints resolve to the same, intended rule, matching the treatment already applied to the download endpoints.
was:
RANGER-5677 made the non-secure {{download}} endpoint URL patterns in {{security-applicationContext.xml}} slash-insensitive ({{{}/*{}}} → {{{}/**{}}}) so that trailing-slash variants resolve to the same Spring Security rule. That change covered only the {{download/*}} endpoints.
The {{{}grant{}}}/{{{}revoke{}}} endpoints still use single-segment {{*}} patterns and were not included:
{{/service/plugins/services/grant/*
/service/plugins/services/revoke/*
/service/assets/resources/grant
/service/assets/resources/revoke}}
Because Jersey resolves a trailing slash to the same resource method (sub-resource methods are compiled with an optional {{(/)?}} suffix) while the Spring Ant matcher {{*}} does not match the trailing-slash form, a request to these endpoints with a trailing slash is matched by a different filter chain than the canonical path. This inconsistency should be removed so all variants of these endpoints resolve to the same, intended rule, matching the treatment already applied to the download endpoints.
> Make grant/revoke endpoint security patterns slash-insensitive (follow-up to RANGER-5677)
> -----------------------------------------------------------------------------------------
>
> Key: RANGER-5819
> URL: https://issues.apache.org/jira/browse/RANGER-5819
> Project: Ranger
> Issue Type: Improvement
> Components: Ranger
> Affects Versions: 2.8.0, 2.9.0
> Reporter: Vyom Mani Tiwari
> Assignee: Vyom Mani Tiwari
> Priority: Major
>
> RANGER-5677 made the non-secure {{download}} endpoint URL patterns in {{security-applicationContext.xml}} slash-insensitive ({{{}/{*}{*}{}}} \{*}→ {{/}}{*}{{{}**{}}}{*}) so that trailing-slash variants resolve to the same Spring Security rule. That change covered only the {{download/}}{*} endpoints.
> The {{{}grant{}}}/{{{}revoke{}}} endpoints still use single-segment {{*}} patterns and were not included:
>
> {{/service/plugins/services/grant/*
> /service/plugins/services/revoke/*
> /service/assets/resources/grant
> /service/assets/resources/revoke}}
> Because Jersey resolves a trailing slash to the same resource method (sub-resource methods are compiled with an optional {{?}} suffix) while the Spring Ant matcher {{*}} does not match the trailing-slash form, a request to these endpoints with a trailing slash is matched by a different filter chain than the canonical path. This inconsistency should be removed so all variants of these endpoints resolve to the same, intended rule, matching the treatment already applied to the download endpoints.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)