Skip to content

Commit 0344b08

Browse files
rjernstrjernst
committed
Remove ignoreUrl file setting property
Urls may make the FileAccessTree invalid. This commit removes the flag for filtering urls, instead always filtering them.
1 parent 91c2654 commit 0344b08

File tree

2 files changed

+13
-42
lines changed

2 files changed

+13
-42
lines changed

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/entitlements/FilesEntitlement.java‎

Lines changed: 7 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -91,8 +91,8 @@ static FileData ofRelativePath(Path relativePath, BaseDir baseDir, Mode mode) {
9191
return new RelativePathFileData(relativePath, baseDir, mode, null, false);
9292
}
9393

94-
static FileData ofPathSetting(String setting, BaseDir baseDir, Mode mode, boolean ignoreUrl) {
95-
return new PathSettingFileData(setting, baseDir, mode, ignoreUrl, null, false);
94+
static FileData ofPathSetting(String setting, BaseDir baseDir, Mode mode) {
95+
return new PathSettingFileData(setting, baseDir, mode,null, false);
9696
}
9797

9898
/**
@@ -221,13 +221,13 @@ public FileData withPlatform(Platform platform) {
221221
}
222222
}
223223

224-
private record PathSettingFileData(String setting, BaseDir baseDir, Mode mode, boolean ignoreUrl, Platform platform, boolean exclusive)
224+
private record PathSettingFileData(String setting, BaseDir baseDir, Mode mode, Platform platform, boolean exclusive)
225225
implements
226226
RelativeFileData {
227227

228228
@Override
229229
public PathSettingFileData withExclusive(boolean exclusive) {
230-
return new PathSettingFileData(setting, baseDir, mode, ignoreUrl, platform, exclusive);
230+
return new PathSettingFileData(setting, baseDir, mode, platform, exclusive);
231231
}
232232

233233
@Override
@@ -239,9 +239,7 @@ public Stream<Path> resolveRelativePaths(PathLookup pathLookup) {
239239
String path = pathLookup.settingResolver().apply(setting);
240240
result = path == null ? Stream.of() : Stream.of(path);
241241
}
242-
if (ignoreUrl) {
243-
result = result.filter(s -> s.toLowerCase(Locale.ROOT).startsWith("https://") == false);
244-
}
242+
result = result.filter(s -> s.toLowerCase(Locale.ROOT).startsWith("https://") == false);
245243
return result.map(pathLookup.configDir()::resolve);
246244
}
247245

@@ -250,7 +248,7 @@ public FileData withPlatform(Platform platform) {
250248
if (platform == platform()) {
251249
return this;
252250
}
253-
return new PathSettingFileData(setting, baseDir, mode, ignoreUrl, platform, exclusive);
251+
return new PathSettingFileData(setting, baseDir, mode, platform, exclusive);
254252
}
255253
}
256254

@@ -338,8 +336,6 @@ public static FilesEntitlement build(List<Object> paths) {
338336
String settingBaseDirAsString = checkString.apply(file, "basedir_if_relative");
339337
String modeAsString = checkString.apply(file, "mode");
340338
String platformAsString = checkString.apply(file, "platform");
341-
Boolean ignoreUrlAsStringBoolean = checkBoolean.apply(file, "ignore_url");
342-
boolean ignoreUrlAsString = ignoreUrlAsStringBoolean != null && ignoreUrlAsStringBoolean;
343339
Boolean exclusiveBoolean = checkBoolean.apply(file, "exclusive");
344340
boolean exclusive = exclusiveBoolean != null && exclusiveBoolean;
345341

@@ -366,9 +362,6 @@ public static FilesEntitlement build(List<Object> paths) {
366362
throw new PolicyValidationException("'relative_to' may only be used with 'relative_path'");
367363
}
368364

369-
if (ignoreUrlAsStringBoolean != null && pathSetting == null) {
370-
throw new PolicyValidationException("'ignore_url' may only be used with 'path_setting'");
371-
}
372365
if (settingBaseDirAsString != null && pathSetting == null) {
373366
throw new PolicyValidationException("'basedir_if_relative' may only be used with 'path_setting'");
374367
}
@@ -395,7 +388,7 @@ public static FilesEntitlement build(List<Object> paths) {
395388
throw new PolicyValidationException("files entitlement with a 'path_setting' must specify 'basedir_if_relative'");
396389
}
397390
BaseDir baseDir = parseBaseDir(settingBaseDirAsString);
398-
fileData = FileData.ofPathSetting(pathSetting, baseDir, mode, ignoreUrlAsString);
391+
fileData = FileData.ofPathSetting(pathSetting, baseDir, mode);
399392
} else {
400393
throw new AssertionError("File entry validation error");
401394
}

‎libs/entitlement/src/test/java/org/elasticsearch/entitlement/runtime/policy/entitlements/FilesEntitlementTests.java‎

Lines changed: 6 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -102,25 +102,25 @@ public void testPathSettingResolve() {
102102
List.of(Map.of("path_setting", "foo.bar", "basedir_if_relative", "config", "mode", "read"))
103103
);
104104
var filesData = entitlement.filesData();
105-
assertThat(filesData, contains(FileData.ofPathSetting("foo.bar", CONFIG, READ, false)));
105+
assertThat(filesData, contains(FileData.ofPathSetting("foo.bar", CONFIG, READ)));
106106

107-
var fileData = FileData.ofPathSetting("foo.bar", CONFIG, READ, false);
107+
var fileData = FileData.ofPathSetting("foo.bar", CONFIG, READ);
108108
// empty settings
109109
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), empty());
110110

111-
fileData = FileData.ofPathSetting("foo.bar", CONFIG, READ, false);
111+
fileData = FileData.ofPathSetting("foo.bar", CONFIG, READ);
112112
settings = Settings.builder().put("foo.bar", "/setting/path").build();
113113
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), contains(Path.of("/setting/path")));
114114

115-
fileData = FileData.ofPathSetting("foo.*.bar", CONFIG, READ, false);
115+
fileData = FileData.ofPathSetting("foo.*.bar", CONFIG, READ);
116116
settings = Settings.builder().put("foo.baz.bar", "/setting/path").build();
117117
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), contains(Path.of("/setting/path")));
118118

119-
fileData = FileData.ofPathSetting("foo.*.bar", CONFIG, READ, false);
119+
fileData = FileData.ofPathSetting("foo.*.bar", CONFIG, READ);
120120
settings = Settings.builder().put("foo.baz.bar", "/setting/path").put("foo.baz2.bar", "/other/path").build();
121121
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), containsInAnyOrder(Path.of("/setting/path"), Path.of("/other/path")));
122122

123-
fileData = FileData.ofPathSetting("foo.bar", CONFIG, READ, false);
123+
fileData = FileData.ofPathSetting("foo.bar", CONFIG, READ);
124124
settings = Settings.builder().put("foo.bar", "relative_path").build();
125125
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), contains(Path.of("/config/relative_path")));
126126
}
@@ -141,28 +141,6 @@ public void testPathSettingBasedirValidation() {
141141
assertThat(e.getMessage(), is("'basedir_if_relative' may only be used with 'path_setting'"));
142142
}
143143

144-
public void testPathSettingIgnoreUrl() {
145-
var fileData = FileData.ofPathSetting("foo.*.bar", CONFIG, READ, true);
146-
settings = Settings.builder().put("foo.nonurl.bar", "/setting/path").put("foo.url.bar", "https://mysite").build();
147-
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), contains(Path.of("/setting/path")));
148-
}
149-
150-
public void testIgnoreUrlValidation() {
151-
var e = expectThrows(
152-
PolicyValidationException.class,
153-
() -> FilesEntitlement.build(List.of(Map.of("path", "/foo", "mode", "read", "ignore_url", true)))
154-
);
155-
assertThat(e.getMessage(), is("'ignore_url' may only be used with 'path_setting'"));
156-
157-
e = expectThrows(
158-
PolicyValidationException.class,
159-
() -> FilesEntitlement.build(
160-
List.of(Map.of("relative_path", "foo", "relative_to", "config", "mode", "read", "ignore_url", true))
161-
)
162-
);
163-
assertThat(e.getMessage(), is("'ignore_url' may only be used with 'path_setting'"));
164-
}
165-
166144
public void testExclusiveParsing() throws Exception {
167145
Policy parsedPolicy = new PolicyParser(new ByteArrayInputStream("""
168146
entitlement-module-name:

0 commit comments

Comments
 (0)