Ranger Plugin still uses Nashorn which is removed in Java 15 and above

[ZhongweiSEC]

When testing Apache Ranger plugin in latest Trino (version 468) docker image, got the following error:

025-01-23T16:25:23.260Z WARN main org.apache.ranger.plugin.conditionevaluator.RangerScriptConditionEvaluator initScriptEngineCreator(): failed to instantiate engine creator org.apache.ranger.plugin.util.NashornScriptEngineCreator
java.lang.NoClassDefFoundError: jdk/nashorn/api/scripting/ClassFilter
at java.base/java.lang.Class.forName0(Native Method)
at java.base/java.lang.Class.forName(Class.java:462)
at java.base/java.lang.Class.forName(Class.java:453)
at org.apache.ranger.plugin.util.ScriptEngineUtil.initScriptEngineCreator(ScriptEngineUtil.java:107)
at org.apache.ranger.plugin.util.ScriptEngineUtil.getScriptEngineCreator(ScriptEngineUtil.java:87)
at org.apache.ranger.plugin.util.ScriptEngineUtil.createScriptEngine(ScriptEngineUtil.java:52)
at org.apache.ranger.plugin.conditionevaluator.RangerScriptConditionEvaluator.init(RangerScriptConditionEvaluator.java:73)
at org.apache.ranger.plugin.conditionevaluator.RangerScriptTemplateConditionEvaluator.init(RangerScriptTemplateConditionEvaluator.java:41)
at org.apache.ranger.plugin.policyevaluator.RangerCustomConditionEvaluator.getConditionEvaluator(RangerCustomConditionEvaluator.java:131)
at org.apache.ranger.plugin.policyevaluator.RangerCustomConditionEvaluator.getConditionEvaluators(RangerCustomConditionEvaluator.java:101)
at org.apache.ranger.plugin.policyevaluator.RangerCustomConditionEvaluator.getPolicyItemConditionEvaluators(RangerCustomConditionEvaluator.java:79)
at org.apache.ranger.plugin.policyevaluator.RangerDefaultPolicyItemEvaluator.init(RangerDefaultPolicyItemEvaluator.java:63)
at org.apache.ranger.plugin.policyevaluator.RangerDefaultPolicyEvaluator.createPolicyItemEvaluators(RangerDefaultPolicyEvaluator.java:1229)
at org.apache.ranger.plugin.policyevaluator.RangerDefaultPolicyEvaluator.init(RangerDefaultPolicyEvaluator.java:138)
at org.apache.ranger.plugin.policyevaluator.RangerOptimizedPolicyEvaluator.init(RangerOptimizedPolicyEvaluator.java:76)
at org.apache.ranger.plugin.policyengine.RangerPolicyRepository.buildPolicyEvaluator(RangerPolicyRepository.java:1102)
at org.apache.ranger.plugin.policyengine.RangerPolicyRepository.init(RangerPolicyRepository.java:919)
at org.apache.ranger.plugin.policyengine.RangerPolicyRepository.(RangerPolicyRepository.java:287)
at org.apache.ranger.plugin.policyengine.PolicyEngine.(PolicyEngine.java:240)
at org.apache.ranger.plugin.policyengine.RangerPolicyEngineImpl.(RangerPolicyEngineImpl.java:99)
at org.apache.ranger.plugin.service.RangerBasePlugin.setPolicies(RangerBasePlugin.java:388)
at org.apache.ranger.plugin.util.PolicyRefresher.loadPolicy(PolicyRefresher.java:257)
at org.apache.ranger.plugin.util.PolicyRefresher.startRefresher(PolicyRefresher.java:139)
at org.apache.ranger.plugin.service.RangerBasePlugin.init(RangerBasePlugin.java:254)
at io.trino.plugin.ranger.RangerSystemAccessControl.(RangerSystemAccessControl.java:159)
at io.trino.plugin.ranger.RangerSystemAccessControl$$FastClassByGuice$$10fbd0.GUICE$TRAMPOLINE()
at io.trino.plugin.ranger.RangerSystemAccessControl$$FastClassByGuice$$10fbd0.apply()
at com.google.inject.internal.DefaultConstructionProxyFactory$FastClassProxy.newInstance(DefaultConstructionProxyFactory.java:82)
at com.google.inject.internal.ConstructorInjector.provision(ConstructorInjector.java:114)
at com.google.inject.internal.ConstructorInjector.access$000(ConstructorInjector.java:33)
at com.google.inject.internal.ConstructorInjector$1.call(ConstructorInjector.java:98)
at com.google.inject.internal.ProvisionListenerStackCallback$Provision.provision(ProvisionListenerStackCallback.java:109)
at io.airlift.bootstrap.LifeCycleModule.provision(LifeCycleModule.java:53)
at com.google.inject.internal.ProvisionListenerStackCallback$Provision.provision(ProvisionListenerStackCallback.java:117)
at com.google.inject.internal.ProvisionListenerStackCallback.provision(ProvisionListenerStackCallback.java:66)
at com.google.inject.internal.ConstructorInjector.construct(ConstructorInjector.java:93)
at com.google.inject.internal.ConstructorBindingImpl$Factory.get(ConstructorBindingImpl.java:300)
at com.google.inject.internal.ProviderToInternalFactoryAdapter.get(ProviderToInternalFactoryAdapter.java:40)
at com.google.inject.internal.SingletonScope$1.get(SingletonScope.java:169)
at com.google.inject.internal.InternalFactoryToProviderAdapter.get(InternalFactoryToProviderAdapter.java:45)
at com.google.inject.internal.InternalInjectorCreator.loadEagerSingletons(InternalInjectorCreator.java:213)
at com.google.inject.internal.InternalInjectorCreator.injectDynamically(InternalInjectorCreator.java:186)
at com.google.inject.internal.InternalInjectorCreator.build(InternalInjectorCreator.java:113)
at com.google.inject.Guice.createInjector(Guice.java:87)
at io.airlift.bootstrap.Bootstrap.initialize(Bootstrap.java:288)
at io.trino.plugin.ranger.RangerSystemAccessControlFactory.create(RangerSystemAccessControlFactory.java:52)
at io.trino.security.AccessControlManager.createSystemAccessControl(AccessControlManager.java:221)
at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:215)
at java.base/java.util.Collections$2.tryAdvance(Collections.java:5075)
at java.base/java.util.Collections$2.forEachRemaining(Collections.java:5083)
at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:570)
at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:560)
at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:921)
at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:265)
at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:727)
at io.trino.security.AccessControlManager.loadSystemAccessControl(AccessControlManager.java:176)
at io.trino.server.Server.doStart(Server.java:174)
at io.trino.server.Server.lambda$start$0(Server.java:94)
at io.trino.$gen.Trino_468____20250123_162503_1.run(Unknown Source)
at io.trino.server.Server.start(Server.java:94)
at io.trino.server.TrinoServer.main(TrinoServer.java:37)
Caused by: java.lang.ClassNotFoundException: jdk.nashorn.api.scripting.ClassFilter
at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:445)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:595)
at io.trino.server.PluginClassLoader.loadClass(PluginClassLoader.java:106)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:528)
... 61 more

[wendigo]

This is a warning, not an error. Does the ranger work?

[ZhongweiSEC]

It is a warning, ranger seems to work. But, this error will negatively impact the application performance.