You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by Colm O hEigeartaigh <co...@apache.org> on 2016/07/12 15:03:15 UTC
Review Request 49954: Invert authorization logic in
RangerSolrAuthorizer
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/49954/
-----------------------------------------------------------
Review request for ranger.
Bugs: RANGER-1095
https://issues.apache.org/jira/browse/RANGER-1095
Repository: ranger
Description
-------
The RangerSolrAuthorizer controls access via a boolean "isDenied" which defaults to false. However, there is a try statement which just logs an error. This is a potential security risk, as a malformed request could cause (e.g.) a NPE which will result in 200 being returned.
Diffs
-----
plugin-solr/src/main/java/org/apache/ranger/authorization/solr/authorizer/RangerSolrAuthorizer.java 4376908
Diff: https://reviews.apache.org/r/49954/diff/
Testing
-------
Tested locally, tests to be submitted separately.
Thanks,
Colm O hEigeartaigh
Re: Review Request 49954: Invert authorization logic in
RangerSolrAuthorizer
Posted by Don Bosco Durai <bo...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/49954/#review141969
-----------------------------------------------------------
Ship it!
Ship It!
- Don Bosco Durai
On July 12, 2016, 3:03 p.m., Colm O hEigeartaigh wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/49954/
> -----------------------------------------------------------
>
> (Updated July 12, 2016, 3:03 p.m.)
>
>
> Review request for ranger.
>
>
> Bugs: RANGER-1095
> https://issues.apache.org/jira/browse/RANGER-1095
>
>
> Repository: ranger
>
>
> Description
> -------
>
> The RangerSolrAuthorizer controls access via a boolean "isDenied" which defaults to false. However, there is a try statement which just logs an error. This is a potential security risk, as a malformed request could cause (e.g.) a NPE which will result in 200 being returned.
>
>
> Diffs
> -----
>
> plugin-solr/src/main/java/org/apache/ranger/authorization/solr/authorizer/RangerSolrAuthorizer.java 4376908
>
> Diff: https://reviews.apache.org/r/49954/diff/
>
>
> Testing
> -------
>
> Tested locally, tests to be submitted separately.
>
>
> Thanks,
>
> Colm O hEigeartaigh
>
>