RANGER-5513:Enhance Ranger lookup API input validation#880
RANGER-5513:Enhance Ranger lookup API input validation#880
Conversation
There was a problem hiding this comment.
Pull request overview
This PR enhances Ranger lookup/autocomplete client input validation to reject potentially unsafe patterns (e.g., path traversal, injection-like inputs) before issuing metadata queries or URL requests.
Changes:
- Added shared validation and pattern-conversion helpers to
BaseClientand applied them across multiple lookup clients (Hive/Presto/Trino/HBase/Elasticsearch). - Reworked JDBC-based metadata lookups (Hive/Presto/Trino) to use
DatabaseMetaDataAPIs and safer pattern handling. - Added/updated unit tests across plugins and introduced additional test dependencies (JUnit Jupiter / Mockito inline + Jupiter integration) where needed.
Reviewed changes
Copilot reviewed 21 out of 21 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| agents-common/src/main/java/org/apache/ranger/plugin/client/BaseClient.java | Adds shared validation/helpers for SQL identifiers, URL resource names, and wildcard patterns. |
| hive-agent/src/main/java/org/apache/ranger/services/hive/client/HiveClient.java | Uses DatabaseMetaData + BaseClient validation for DB/table/column lookup paths. |
| hive-agent/src/test/java/org/apache/ranger/services/hive/client/TestHiveClient.java | Updates JDBC-path mocking to DatabaseMetaData; adds validation-focused tests. |
| plugin-presto/src/main/java/org/apache/ranger/services/presto/client/PrestoClient.java | Switches catalog/schema/table/column lookups to DatabaseMetaData + validation. |
| plugin-presto/src/test/java/org/apache/ranger/services/presto/client/TestPrestoClient.java | Adds static-mocking tests validating rejection of malicious inputs. |
| plugin-presto/pom.xml | Adds Mockito inline + JUnit Jupiter integration deps for tests. |
| plugin-trino/src/main/java/org/apache/ranger/services/trino/client/TrinoClient.java | Switches lookups to DatabaseMetaData + validation; adjusts escaping helper. |
| plugin-trino/src/test/java/org/apache/ranger/services/trino/client/TestTrinoClient.java | Adds static-mocking tests validating rejection of malicious inputs. |
| plugin-trino/pom.xml | Adds Mockito inline + JUnit Jupiter integration deps for tests. |
| hbase-agent/src/main/java/org/apache/ranger/services/hbase/client/HBaseClient.java | Validates wildcard patterns and converts wildcards to safe regex before compiling. |
| hbase-agent/src/test/java/org/apache/ranger/services/hbase/client/TestHBaseClient.java | Updates patterns to glob-style and adds validation/regex-safety tests. |
| plugin-elasticsearch/src/main/java/org/apache/ranger/services/elasticsearch/client/ElasticsearchClient.java | Validates indexMatching before building request path. |
| plugin-elasticsearch/src/test/java/org/apache/ranger/services/elasticsearch/client/TestElasticsearchClient.java | Adds tests for URL resource-name validation via reflection. |
| plugin-elasticsearch/pom.xml | Adds JUnit Jupiter + Mockito test dependencies. |
| plugin-solr/src/main/java/org/apache/ranger/services/solr/client/ServiceSolrClient.java | Validates collection name before using it in URL path construction. |
| plugin-solr/src/test/java/org/apache/ranger/services/solr/client/TestServiceSolrClient.java | Adds tests validating collection-name rejection/acceptance behavior. |
| plugin-solr/pom.xml | Adds JUnit Jupiter + Mockito test dependencies. |
| knox-agent/src/main/java/org/apache/ranger/services/knox/client/KnoxClient.java | Validates topology names before building request URLs. |
| knox-agent/src/test/java/org/apache/ranger/services/knox/client/TestKnoxClient.java | Adds tests for Knox topology-name validation via reflection. |
| plugin-schema-registry/src/main/java/org/apache/ranger/services/schema/registry/client/AutocompletionAgent.java | Adds pattern validation + wildcard-to-regex conversion before matching schema names. |
| plugin-schema-registry/src/test/java/org/apache/ranger/services/schema/registry/client/AutocompletionAgentTest.java | Adds tests around pattern validation and wildcard behavior. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
agents-common/src/main/java/org/apache/ranger/plugin/client/BaseClient.java
Outdated
Show resolved
Hide resolved
agents-common/src/main/java/org/apache/ranger/plugin/client/BaseClient.java
Outdated
Show resolved
Hide resolved
agents-common/src/main/java/org/apache/ranger/plugin/client/BaseClient.java
Outdated
Show resolved
Hide resolved
...try/src/main/java/org/apache/ranger/services/schema/registry/client/AutocompletionAgent.java
Show resolved
Hide resolved
agents-common/src/main/java/org/apache/ranger/plugin/client/BaseClient.java
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 21 out of 21 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
agents-common/src/main/java/org/apache/ranger/plugin/client/BaseClient.java
Show resolved
Hide resolved
agents-common/src/main/java/org/apache/ranger/plugin/client/BaseClient.java
Show resolved
Hide resolved
...try/src/main/java/org/apache/ranger/services/schema/registry/client/AutocompletionAgent.java
Show resolved
Hide resolved
plugin-trino/src/main/java/org/apache/ranger/services/trino/client/TrinoClient.java
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 21 out of 21 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
agents-common/src/main/java/org/apache/ranger/plugin/client/BaseClient.java
Outdated
Show resolved
Hide resolved
...try/src/main/java/org/apache/ranger/services/schema/registry/client/AutocompletionAgent.java
Show resolved
Hide resolved
agents-common/src/main/java/org/apache/ranger/plugin/client/BaseClient.java
Show resolved
Hide resolved
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 21 out of 21 changed files in this pull request and generated 5 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
What changes were proposed in this pull request?
To enhance Ranger lookup functionality input validation. Ranger Lookup clients inputs are validated before send to the respective service for execution.
How was this patch tested?
Tests create and testing in local vm
Ran tests:
mvn test -s ~/.m2/empty-settings.xml -pl hive-agent -Dtest=TestHiveClient
mvn test -s ~/.m2/empty-settings.xml -pl hbase-agent -Dtest=TestHBaseClient
mvn test -s ~/.m2/empty-settings.xml -pl plugin-trino -Dtest=TestTrinoClient
mvn test -s ~/.m2/empty-settings.xml -pl plugin-presto -Dtest=TestPrestoClient
mvn test -s ~/.m2/empty-settings.xml -pl plugin-solr -Dtest=TestServiceSolrClient
mvn test -s ~/.m2/empty-settings.xml -pl plugin-elasticsearch -Dtest=TestElasticsearchClient
mvn test -s ~/.m2/empty-settings.xml -pl knox-agent -Dtest=TestKnoxClient
mvn test -s ~/.m2/empty-settings.xml -pl plugin-schema-registry -Dtest=AutocompletionAgentTest