CVE-2016-0735

@@ -222,4 +222,32 @@ public StringBuilder toString(StringBuilder sb) {
 
 		return sb;
 	}
+
+	/**
+	 * Is resource asking to authorize all possible values at this level?
+	 * @param resource
+	 * @return
+	 */
+	boolean isAllValuesRequested(String resource) {
+		boolean result = StringUtils.isEmpty(resource) || WILDCARD_ASTERISK.equals(resource);
+		if (LOG.isDebugEnabled()) {
+			LOG.debug("isAllValuesRequested(" + resource + "): " + result);
+		}
+		return result;
+	}
+
+	/**
+	 * The only case where excludes flag does NOT change the result is the following:
+	 * - Resource denotes all possible values (i.e. resource in (null, "", "*")
+	 * - where as policy does not allow all possible values (i.e. policy.values().contains("*")
+	 *
+	 * @param allValuesRequested
+	 * @param resultWithoutExcludes
+     * @return
+     */
+	public boolean applyExcludes(boolean allValuesRequested, boolean resultWithoutExcludes) {
+		if (!policyIsExcludes) return resultWithoutExcludes;                   // not an excludes policy!
+		if (allValuesRequested && !isMatchAny)  return resultWithoutExcludes;  // one case where excludes has no effect
+		return !resultWithoutExcludes;                                         // all other cases flip it
+	}
 }

@@ -37,8 +37,9 @@ public boolean isMatch(String resource) {
 		}
 
 		boolean ret = false;
+		boolean allValuesRequested = isAllValuesRequested(resource);
 
-		if(resource == null || isMatchAny) {
+		if(allValuesRequested || isMatchAny) {
 			ret = isMatchAny;
 		} else {
 			for(String policyValue : policyValues) {
@@ -56,9 +57,7 @@ public boolean isMatch(String resource) {
 			}
 		}
 
-		if(policyIsExcludes) {
-			ret = !ret;
-		}
+		ret = applyExcludes(allValuesRequested, ret);
 
 		if(LOG.isDebugEnabled()) {
 			LOG.debug("<== RangerDefaultResourceMatcher.isMatch(" + resource + "): " + ret);

@@ -78,8 +78,9 @@ public boolean isMatch(String resource) {
 		}
 
 		boolean ret = false;
+		boolean allValuesRequested = isAllValuesRequested(resource);
 
-		if(resource == null || isMatchAny) {
+		if(allValuesRequested || isMatchAny) {
 			ret = isMatchAny;
 		} else {
 			IOCase caseSensitivity = optIgnoreCase ? IOCase.INSENSITIVE : IOCase.SENSITIVE;
@@ -103,9 +104,7 @@ public boolean isMatch(String resource) {
 			}
 		}
 
-		if(policyIsExcludes) {
-			ret = !ret;
-		}
+		ret = applyExcludes(allValuesRequested, ret);
 
 		if(LOG.isDebugEnabled()) {
 			LOG.debug("<== RangerPathResourceMatcher.isMatch(" + resource + "): " + ret);

@@ -0,0 +1,32 @@
+package org.apache.ranger.plugin.resourcematcher;
+
+import org.junit.Test;
+
+import static org.junit.Assert.*;
+
+/**
+ * Created by alal on 1/29/16.
+ */
+public class RangerAbstractResourceMatcherTest {
+
+    @Test
+    public void test_isAllPossibleValues() {
+        RangerAbstractResourceMatcher matcher = new AbstractMatcherWrapper();
+        for (String resource : new String[] { null, "", "*"}) {
+            assertTrue(matcher.isAllValuesRequested(resource));
+        }
+
+        for (String resource : new String[] { " ", "\t", "\n", "foo"}) {
+            assertFalse(matcher.isAllValuesRequested(resource));
+        }
+    }
+
+    static class AbstractMatcherWrapper extends RangerAbstractResourceMatcher {
+
+        @Override
+        public boolean isMatch(String resource) {
+            fail("This method is not expected to be used by test!");
+            return false;
+        }
+    }
+}
\ No newline at end of file

@@ -0,0 +1,58 @@
+package org.apache.ranger.plugin.resourcematcher;
+
+import com.google.common.collect.Lists;
+import org.junit.Test;
+
+import static org.junit.Assert.*;
+
+/**
+ * Created by alal on 2/1/16.
+ */
+public class RangerDefaultResourceMatcherTest {
+
+    Object[][] data = {
+            // { resource, policy, excludes, result
+            { "*",  "*",  false, true },  // resource is all values
+            { "*",  "*",  true,  false },
+            { "*",  "a*", false, false }, // but, policy is not match any
+            { "*",  "a*", true,  false }, // ==> compare with above: exclude flag has no effect here
+            { "a*", "a",  false, false }, // resource has regex marker!
+            { "a*", "a",  true,  true },
+            { "a",  "a",  false, true },  // exact match
+            { "a",  "a",  true,  false },
+            { "a1", "a*", false, true },  // trivial regex match
+            { "a1", "a*", true,  false },
+    };
+
+    @Test
+    public void testIsMatch() throws Exception {
+        for (Object[] row : data) {
+            String resource = (String)row[0];
+            String policyValue = (String)row[1];
+            boolean excludes = (boolean)row[2];
+            boolean result = (boolean)row[3];
+
+            MatcherWrapper matcher = new MatcherWrapper(policyValue, excludes);
+            assertEquals(getMessage(row), result, matcher.isMatch(resource));
+        }
+    }
+
+    String getMessage(Object[] row) {
+        return String.format("Resource=%s, Policy=%s, excludes=%s, result=%s",
+                (String)row[0], (String)row[1], (boolean)row[2], (boolean)row[3]);
+    }
+
+    static class MatcherWrapper extends RangerDefaultResourceMatcher {
+        MatcherWrapper(String policyValue, boolean exclude) {
+            this.policyValues = Lists.newArrayList(policyValue);
+            if (WILDCARD_ASTERISK.equals(policyValue)) {
+                this.isMatchAny = true;
+            }
+            if (policyValue.contains(WILDCARD_ASTERISK)) {
+                this.optWildCard = true;
+            }
+            this.policyIsExcludes = exclude;
+        }
+    }
+
+}
\ No newline at end of file