[jira] [Commented] (RANGER-1198) REST API: 404 while retrieving and updating a policy with a slash in the name

["Jiahao Niu (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/RANGER-1198?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15631083#comment-15631083 ] 

Jiahao Niu commented on RANGER-1198:
------------------------------------

Please describe the details of bug.
thanks

> REST API: 404 while retrieving and updating a policy with a slash in the name
> -----------------------------------------------------------------------------
>
>                 Key: RANGER-1198
>                 URL: https://issues.apache.org/jira/browse/RANGER-1198
>             Project: Ranger
>          Issue Type: Bug
>    Affects Versions: 0.6.0, 0.7.0, 0.6.1
>            Reporter: André Frimberger
>
> A policy, which is created via Ranger's admin UI can contain slashes, e.g. ("MyPolicy Read/Execute" or "/tmp/some/test"). However, updating or retrieving such a policy via the REST API _fails_ with a _Bad Request_ or _Not found_.
> For retrieving ({{GET}}) and updating ({{PUT}}) a policy, its name is transferred as {{@PathParam}}:
> {code}
> @Path("/api/service/{servicename}/policy/{policyname}")
> {code}
> Obviously, {{@PathParam}} parameters shouldn't contain slashes, because they're interpreted as path separators. URL encoding {{policyname}} doesn't work (Bad Request is returned), either. Due to security implications (Directoy traversal attack - https://en.wikipedia.org/wiki/Directory_traversal_attack) Tomcat filters %2F from the URL path.
> I suggest to pass {{servicename}} and {{policyname}} as "query" or in case of updating in the message body.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)