root
/
kafka
mirror of https://github.com/apache/kafka.git
1
0
Fork 0
Code Issues Actions 2 Packages Projects Releases Wiki Activity

KAFKA-18051: Disallow creating ACLs with principals that do not contain a colon (#17883) 

Kafka Principals must contain a colon. We should enforce this in createAcls.

Reviewers: David Arthur <mumrah@gmail.com>
This commit is contained in:
Colin Patrick McCabe 2024-11-22 16:50:33 -08:00 committed by GitHub
parent 866f0cc308
commit cd36d64535
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 34 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
metadata/src/main/java/org/apache/kafka/controller/AclControlManager.java
View File

@ -160,6 +160,12 @@ public class AclControlManager {
if (binding.pattern().name() == null || binding.pattern().name().isEmpty()) {
throw new InvalidRequestException("Resource name should not be empty");
}
int colonIndex = binding.entry().principal().indexOf(":");
if (colonIndex == -1) {
throw new InvalidRequestException("Could not parse principal from `" +
binding.entry().principal() + "` " + "(no colon is present separating the " +
"principal type from the principal name)");
}
}
ControllerResult<List<AclDeleteResult>> deleteAcls(List<AclBindingFilter> filters) {

28
metadata/src/test/java/org/apache/kafka/controller/AclControlManagerTest.java
View File

@ -114,6 +114,34 @@ public class AclControlManagerTest {
getMessage());
}
/**
* Verify that validateNewAcl catches invalid ACLs with principals that do not contain a colon.
*/
@Test
public void testValidateAclWithBadPrincipal() {
assertEquals("Could not parse principal from `invalid` (no colon is present " +
"separating the principal type from the principal name)",
assertThrows(InvalidRequestException.class, () ->
AclControlManager.validateNewAcl(new AclBinding(
new ResourcePattern(TOPIC, "*", LITERAL),
new AccessControlEntry("invalid", "*", ALTER, ALLOW)))).
getMessage());
}
/**
* Verify that validateNewAcl catches invalid ACLs with principals that do not contain a colon.
*/
@Test
public void testValidateAclWithEmptyPrincipal() {
assertEquals("Could not parse principal from `` (no colon is present " +
"separating the principal type from the principal name)",
assertThrows(InvalidRequestException.class, () ->
AclControlManager.validateNewAcl(new AclBinding(
new ResourcePattern(TOPIC, "*", LITERAL),
new AccessControlEntry("", "*", ALTER, ALLOW)))).
getMessage());
}
/**
* Verify that validateFilter catches invalid filters.
*/