Skip to content

Commit

Permalink
Remove ignoreUrl file setting property (#123718)
Browse files Browse the repository at this point in the history 
Urls may make the FileAccessTree invalid. This commit removes the flag
for filtering urls, instead always filtering them.
  • Loading branch information
@rjernst
rjernst authored Mar 2, 2025
1 parent 39a2e88 commit eace6a1
Show file tree
Hide file tree
Showing 2 changed files with 16 additions and 44 deletions.
26 changes: 10 additions & 16 deletions ...main/java/org/elasticsearch/entitlement/runtime/policy/entitlements/FilesEntitlement.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -91,8 +91,8 @@ static FileData ofRelativePath(Path relativePath, BaseDir baseDir, Mode mode) {
return new RelativePathFileData(relativePath, baseDir, mode, null, false);
}

static FileData ofPathSetting(String setting, BaseDir baseDir, Mode mode, boolean ignoreUrl) {
return new PathSettingFileData(setting, baseDir, mode, ignoreUrl, null, false);
static FileData ofPathSetting(String setting, BaseDir baseDir, Mode mode) {
return new PathSettingFileData(setting, baseDir, mode, null, false);
}

/**
Expand Down Expand Up @@ -220,30 +220,29 @@ public FileData withPlatform(Platform platform) {
}
}

private record PathSettingFileData(String setting, BaseDir baseDir, Mode mode, boolean ignoreUrl, Platform platform, boolean exclusive)
private record PathSettingFileData(String setting, BaseDir baseDir, Mode mode, Platform platform, boolean exclusive)
implements
RelativeFileData {

@Override
public PathSettingFileData withExclusive(boolean exclusive) {
return new PathSettingFileData(setting, baseDir, mode, ignoreUrl, platform, exclusive);
return new PathSettingFileData(setting, baseDir, mode, platform, exclusive);
}

@Override
public Stream<Path> resolveRelativePaths(PathLookup pathLookup) {
Stream<String> result = pathLookup.settingResolver().apply(setting);
if (ignoreUrl) {
result = result.filter(s -> s.toLowerCase(Locale.ROOT).startsWith("https://") == false);
}
return result.map(pathLookup.configDir()::resolve);
Stream<String> result = pathLookup.settingResolver()
.apply(setting)
.filter(s -> s.toLowerCase(Locale.ROOT).startsWith("https://") == false);
return result.map(Path::of);
}

@Override
public FileData withPlatform(Platform platform) {
if (platform == platform()) {
return this;
}
return new PathSettingFileData(setting, baseDir, mode, ignoreUrl, platform, exclusive);
return new PathSettingFileData(setting, baseDir, mode, platform, exclusive);
}
}

Expand Down Expand Up @@ -331,8 +330,6 @@ public static FilesEntitlement build(List<Object> paths) {
String settingBaseDirAsString = checkString.apply(file, "basedir_if_relative");
String modeAsString = checkString.apply(file, "mode");
String platformAsString = checkString.apply(file, "platform");
Boolean ignoreUrlAsStringBoolean = checkBoolean.apply(file, "ignore_url");
boolean ignoreUrlAsString = ignoreUrlAsStringBoolean != null && ignoreUrlAsStringBoolean;
Boolean exclusiveBoolean = checkBoolean.apply(file, "exclusive");
boolean exclusive = exclusiveBoolean != null && exclusiveBoolean;

Expand All @@ -359,9 +356,6 @@ public static FilesEntitlement build(List<Object> paths) {
throw new PolicyValidationException("'relative_to' may only be used with 'relative_path'");
}

if (ignoreUrlAsStringBoolean != null && pathSetting == null) {
throw new PolicyValidationException("'ignore_url' may only be used with 'path_setting'");
}
if (settingBaseDirAsString != null && pathSetting == null) {
throw new PolicyValidationException("'basedir_if_relative' may only be used with 'path_setting'");
}
Expand All @@ -388,7 +382,7 @@ public static FilesEntitlement build(List<Object> paths) {
throw new PolicyValidationException("files entitlement with a 'path_setting' must specify 'basedir_if_relative'");
}
BaseDir baseDir = parseBaseDir(settingBaseDirAsString);
fileData = FileData.ofPathSetting(pathSetting, baseDir, mode, ignoreUrlAsString);
fileData = FileData.ofPathSetting(pathSetting, baseDir, mode);
} else {
throw new AssertionError("File entry validation error");
}
Expand Down
34 changes: 6 additions & 28 deletions ...java/org/elasticsearch/entitlement/runtime/policy/entitlements/FilesEntitlementTests.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -101,25 +101,25 @@ public void testPathSettingResolve() {
List.of(Map.of("path_setting", "foo.bar", "basedir_if_relative", "config", "mode", "read"))
);
var filesData = entitlement.filesData();
assertThat(filesData, contains(FileData.ofPathSetting("foo.bar", CONFIG, READ, false)));
assertThat(filesData, contains(FileData.ofPathSetting("foo.bar", CONFIG, READ)));

var fileData = FileData.ofPathSetting("foo.bar", CONFIG, READ, false);
var fileData = FileData.ofPathSetting("foo.bar", CONFIG, READ);
// empty settings
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), empty());

fileData = FileData.ofPathSetting("foo.bar", CONFIG, READ, false);
fileData = FileData.ofPathSetting("foo.bar", CONFIG, READ);
settings = Settings.builder().put("foo.bar", "/setting/path").build();
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), contains(Path.of("/setting/path")));

fileData = FileData.ofPathSetting("foo.*.bar", CONFIG, READ, false);
fileData = FileData.ofPathSetting("foo.*.bar", CONFIG, READ);
settings = Settings.builder().put("foo.baz.bar", "/setting/path").build();
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), contains(Path.of("/setting/path")));

fileData = FileData.ofPathSetting("foo.*.bar", CONFIG, READ, false);
fileData = FileData.ofPathSetting("foo.*.bar", CONFIG, READ);
settings = Settings.builder().put("foo.baz.bar", "/setting/path").put("foo.baz2.bar", "/other/path").build();
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), containsInAnyOrder(Path.of("/setting/path"), Path.of("/other/path")));

fileData = FileData.ofPathSetting("foo.bar", CONFIG, READ, false);
fileData = FileData.ofPathSetting("foo.bar", CONFIG, READ);
settings = Settings.builder().put("foo.bar", "relative_path").build();
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), contains(Path.of("/config/relative_path")));
}
Expand All @@ -140,28 +140,6 @@ public void testPathSettingBasedirValidation() {
assertThat(e.getMessage(), is("'basedir_if_relative' may only be used with 'path_setting'"));
}

public void testPathSettingIgnoreUrl() {
var fileData = FileData.ofPathSetting("foo.*.bar", CONFIG, READ, true);
settings = Settings.builder().put("foo.nonurl.bar", "/setting/path").put("foo.url.bar", "https://mysite").build();
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), contains(Path.of("/setting/path")));
}

public void testIgnoreUrlValidation() {
var e = expectThrows(
PolicyValidationException.class,
() -> FilesEntitlement.build(List.of(Map.of("path", "/foo", "mode", "read", "ignore_url", true)))
);
assertThat(e.getMessage(), is("'ignore_url' may only be used with 'path_setting'"));

e = expectThrows(
PolicyValidationException.class,
() -> FilesEntitlement.build(
List.of(Map.of("relative_path", "foo", "relative_to", "config", "mode", "read", "ignore_url", true))
)
);
assertThat(e.getMessage(), is("'ignore_url' may only be used with 'path_setting'"));
}

public void testExclusiveParsing() throws Exception {
Policy parsedPolicy = new PolicyParser(new ByteArrayInputStream("""
entitlement-module-name:
Expand Down

0 comments on commit eace6a1

Please sign in to comment.