[GEODE-6985] Implement RestrictedMethodAuthorizer

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.11.0
• Component/s: querying
• Labels: GeodeCommons
• Assignee: Juan Ramos
• Reporter: Juan Ramos
• Created: 19/Jul/19 13:42
• Updated: 30/Dec/19 18:49
• Resolved: 23/Sep/19 19:13

Description

Implement the RestrictedMethodAuthorizer class.

• Make sure the class is immutable and thread safe.
• Add two new public methods to the implementation:
  • isAllowedGeodeMethod: it should return true when the Method on the target Object is considered safe (Region.get, Region.entrySet, Region.keySet, Region.values, Region.getEntries, Region.getValues, Region.containsKey, Region.getKey and Region.getValue), and false otherwise.
  • isKnownDangerousMethod: it should return true when the Method on the target Object is known to be a non-safe method. Including but not limited to getClass, which allows the user to execute anything using reflection.
• Implement unit tests for the class and all of its methods.
• Add comprehensive and clear documentation to the class and all its public methods so customers can use it without leaving their IDE.

Issue Links

• is a child of: GEODE-6983 Epic for OQL Method Invocation Security
• is blocked by: GEODE-6984 Publish MethodInvocationAuthorizer and RestrictedMethodInvocationAuthorizer
• links to: GitHub Pull Request #4077