[KAFKA-7185] getMatchingAcls throws StringIndexOutOfBoundsException for empty resource name

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 2.0.0
• Fix Version/s: 2.0.0
• Assignee: Dhruvil Shah
• Reporter: Dhruvil Shah
• Reviewer: Ismael Juma
• Created: 19/Jul/18 20:53
• Updated: 20/Jul/18 19:40
• Resolved: 20/Jul/18 19:40

Description

KIP-290 introduced a way to match ACLs based on prefix. Certain resource names like that for group id can be empty strings. When an empty string is passed into `getMatchingAcls`, it would throw a `StringIndexOutOfBoundsException` because of the following logic:

val prefixed = aclCache.range(
 Resource(resourceType, resourceName, PatternType.PREFIXED),
 Resource(resourceType, resourceName.substring(0, Math.min(1, resourceName.length)), PatternType.PREFIXED)
 )
 .filterKeys(resource => resourceName.startsWith(resource.name))
 .flatMap { case (resource, versionedAcls) => versionedAcls.acls }
 .toSet

This is a regression introduced in 2.0.

Issue Links

• links to: GitHub Pull Request #5400