Move more nontrivial logic to PolicyChecker

Author: prdoyle

libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/api/ElasticsearchEntitlementChecker.java

@@ -35,11 +35,9 @@
 import java.net.DatagramSocket;
 import java.net.DatagramSocketImplFactory;
 import java.net.FileNameMap;
-import java.net.HttpURLConnection;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.JarURLConnection;
-import java.net.MalformedURLException;
 import java.net.MulticastSocket;
 import java.net.NetworkInterface;
 import java.net.Proxy;
@@ -50,9 +48,7 @@
 import java.net.SocketAddress;
 import java.net.SocketImplFactory;
 import java.net.URI;
-import java.net.URISyntaxException;
 import java.net.URL;
-import java.net.URLConnection;
 import java.net.URLStreamHandler;
 import java.net.URLStreamHandlerFactory;
 import java.net.http.HttpClient;
@@ -77,7 +73,6 @@
 import java.nio.file.NoSuchFileException;
 import java.nio.file.OpenOption;
 import java.nio.file.Path;
-import java.nio.file.Paths;
 import java.nio.file.StandardOpenOption;
 import java.nio.file.WatchEvent;
 import java.nio.file.WatchService;
@@ -646,162 +641,67 @@ public ElasticsearchEntitlementChecker(PolicyChecker policyChecker) {
         policyChecker.checkOutboundNetworkAccess(callerClass);
     }
 
-    @SuppressWarnings("deprecation")
-    private URL extractJarFileUrl(URL jarUrl) {
-        String spec = jarUrl.getFile();
-        int separator = spec.indexOf("!/");
-
-        // URL does not handle nested JAR URLs (it would be a MalformedURLException upon connection)
-        if (separator == -1) {
-            return null;
-        }
-
-        try {
-            return new URL(spec.substring(0, separator));
-        } catch (MalformedURLException e) {
-            return null;
-        }
-    }
-
-    private boolean handleNetworkOrFileUrlCheck(Class<?> callerClass, URL url) {
-        if (isNetworkUrl(url)) {
-            policyChecker.checkOutboundNetworkAccess(callerClass);
-            return true;
-        }
-        if (isFileUrl(url)) {
-            checkURLFileRead(callerClass, url);
-            return true;
-        }
-        return false;
-    }
-
-    private void checkJarURLAccess(Class<?> callerClass, JarURLConnection that) {
-        var jarFileUrl = that.getJarFileURL();
-        if (handleNetworkOrFileUrlCheck(callerClass, jarFileUrl)) {
-            return;
-        }
-        policyChecker.checkUnsupportedURLProtocolConnection(callerClass, jarFileUrl.getProtocol());
-    }
-
-    private void checkEntitlementForUrl(Class<?> callerClass, URL that) {
-        if (handleNetworkOrFileUrlCheck(callerClass, that)) {
-            return;
-        }
-        if (isJarUrl(that)) {
-            var jarFileUrl = extractJarFileUrl(that);
-            if (jarFileUrl == null || handleNetworkOrFileUrlCheck(callerClass, jarFileUrl) == false) {
-                policyChecker.checkUnsupportedURLProtocolConnection(callerClass, "jar with unsupported inner protocol");
-            }
-        } else {
-            policyChecker.checkUnsupportedURLProtocolConnection(callerClass, that.getProtocol());
-        }
-    }
-
     @Override
     public void check$java_net_URL$openConnection(Class<?> callerClass, java.net.URL that) {
-        checkEntitlementForUrl(callerClass, that);
+        policyChecker.checkEntitlementForUrl(callerClass, that);
     }
 
     @Override
     public void check$java_net_URL$openConnection(Class<?> callerClass, URL that, Proxy proxy) {
         if (proxy.type() != Proxy.Type.DIRECT) {
             policyChecker.checkOutboundNetworkAccess(callerClass);
         }
-        checkEntitlementForUrl(callerClass, that);
+        policyChecker.checkEntitlementForUrl(callerClass, that);
     }
 
     @Override
     public void check$java_net_URL$openStream(Class<?> callerClass, java.net.URL that) {
-        checkEntitlementForUrl(callerClass, that);
+        policyChecker.checkEntitlementForUrl(callerClass, that);
     }
 
     @Override
     public void check$java_net_URL$getContent(Class<?> callerClass, java.net.URL that) {
-        checkEntitlementForUrl(callerClass, that);
+        policyChecker.checkEntitlementForUrl(callerClass, that);
     }
 
     @Override
     public void check$java_net_URL$getContent(Class<?> callerClass, java.net.URL that, Class<?>[] classes) {
-        checkEntitlementForUrl(callerClass, that);
-    }
-
-    private static final Set<String> NETWORK_PROTOCOLS = Set.of("http", "https", "ftp", "mailto");
-
-    private static boolean isNetworkUrl(java.net.URL url) {
-        return NETWORK_PROTOCOLS.contains(url.getProtocol());
-    }
-
-    private static boolean isFileUrl(java.net.URL url) {
-        return "file".equals(url.getProtocol());
-    }
-
-    private static boolean isJarUrl(java.net.URL url) {
-        return "jar".equals(url.getProtocol());
-    }
-
-    // We have to use class names for sun.net.www classes as java.base does not export them
-    private static final List<String> ADDITIONAL_NETWORK_URL_CONNECT_CLASS_NAMES = List.of(
-        "sun.net.www.protocol.ftp.FtpURLConnection",
-        "sun.net.www.protocol.mailto.MailToURLConnection"
-    );
-
-    private static boolean isNetworkUrlConnection(java.net.URLConnection urlConnection) {
-        var connectionClass = urlConnection.getClass();
-        return HttpURLConnection.class.isAssignableFrom(connectionClass)
-            || ADDITIONAL_NETWORK_URL_CONNECT_CLASS_NAMES.contains(connectionClass.getName());
-    }
-
-    // We have to use class names for sun.net.www classes as java.base does not export them
-    private static boolean isFileUrlConnection(java.net.URLConnection urlConnection) {
-        var connectionClass = urlConnection.getClass();
-        return "sun.net.www.protocol.file.FileURLConnection".equals(connectionClass.getName());
-    }
-
-    private void checkEntitlementForURLConnection(Class<?> callerClass, URLConnection that) {
-        if (isNetworkUrlConnection(that)) {
-            policyChecker.checkOutboundNetworkAccess(callerClass);
-        } else if (isFileUrlConnection(that)) {
-            checkURLFileRead(callerClass, that.getURL());
-        } else if (that instanceof JarURLConnection jarURLConnection) {
-            checkJarURLAccess(callerClass, jarURLConnection);
-        } else {
-            policyChecker.checkUnsupportedURLProtocolConnection(callerClass, that.getURL().getProtocol());
-        }
+        policyChecker.checkEntitlementForUrl(callerClass, that);
     }
 
     @Override
     public void check$java_net_URLConnection$getContentLength(Class<?> callerClass, java.net.URLConnection that) {
-        checkEntitlementForURLConnection(callerClass, that);
+        policyChecker.checkEntitlementForURLConnection(callerClass, that);
     }
 
     @Override
     public void check$java_net_URLConnection$getContentLengthLong(Class<?> callerClass, java.net.URLConnection that) {
-        checkEntitlementForURLConnection(callerClass, that);
+        policyChecker.checkEntitlementForURLConnection(callerClass, that);
     }
 
     @Override
     public void check$java_net_URLConnection$getContentType(Class<?> callerClass, java.net.URLConnection that) {
-        checkEntitlementForURLConnection(callerClass, that);
+        policyChecker.checkEntitlementForURLConnection(callerClass, that);
     }
 
     @Override
     public void check$java_net_URLConnection$getContentEncoding(Class<?> callerClass, java.net.URLConnection that) {
-        checkEntitlementForURLConnection(callerClass, that);
+        policyChecker.checkEntitlementForURLConnection(callerClass, that);
     }
 
     @Override
     public void check$java_net_URLConnection$getExpiration(Class<?> callerClass, java.net.URLConnection that) {
-        checkEntitlementForURLConnection(callerClass, that);
+        policyChecker.checkEntitlementForURLConnection(callerClass, that);
     }
 
     @Override
     public void check$java_net_URLConnection$getDate(Class<?> callerClass, java.net.URLConnection that) {
-        checkEntitlementForURLConnection(callerClass, that);
+        policyChecker.checkEntitlementForURLConnection(callerClass, that);
     }
 
     @Override
     public void check$java_net_URLConnection$getLastModified(Class<?> callerClass, java.net.URLConnection that) {
-        checkEntitlementForURLConnection(callerClass, that);
+        policyChecker.checkEntitlementForURLConnection(callerClass, that);
     }
 
     @Override
@@ -811,7 +711,7 @@ private void checkEntitlementForURLConnection(Class<?> callerClass, URLConnectio
         String name,
         int defaultValue
     ) {
-        checkEntitlementForURLConnection(callerClass, that);
+        policyChecker.checkEntitlementForURLConnection(callerClass, that);
     }
 
     @Override
@@ -821,7 +721,7 @@ private void checkEntitlementForURLConnection(Class<?> callerClass, URLConnectio
         String name,
         long defaultValue
     ) {
-        checkEntitlementForURLConnection(callerClass, that);
+        policyChecker.checkEntitlementForURLConnection(callerClass, that);
     }
 
     @Override
@@ -831,17 +731,17 @@ private void checkEntitlementForURLConnection(Class<?> callerClass, URLConnectio
         String name,
         long defaultValue
     ) {
-        checkEntitlementForURLConnection(callerClass, that);
+        policyChecker.checkEntitlementForURLConnection(callerClass, that);
     }
 
     @Override
     public void check$java_net_URLConnection$getContent(Class<?> callerClass, java.net.URLConnection that) {
-        checkEntitlementForURLConnection(callerClass, that);
+        policyChecker.checkEntitlementForURLConnection(callerClass, that);
     }
 
     @Override
     public void check$java_net_URLConnection$getContent(Class<?> callerClass, java.net.URLConnection that, Class<?>[] classes) {
-        checkEntitlementForURLConnection(callerClass, that);
+        policyChecker.checkEntitlementForURLConnection(callerClass, that);
     }
 
     @Override
@@ -867,32 +767,32 @@ private void checkEntitlementForURLConnection(Class<?> callerClass, URLConnectio
     // Using java.net.URLConnection for "that" as sun.net.www.URLConnection is not exported
     @Override
     public void check$sun_net_www_URLConnection$getHeaderField(Class<?> callerClass, java.net.URLConnection that, String name) {
-        checkEntitlementForURLConnection(callerClass, that);
+        policyChecker.checkEntitlementForURLConnection(callerClass, that);
     }
 
     @Override
     public void check$sun_net_www_URLConnection$getHeaderFields(Class<?> callerClass, java.net.URLConnection that) {
-        checkEntitlementForURLConnection(callerClass, that);
+        policyChecker.checkEntitlementForURLConnection(callerClass, that);
     }
 
     @Override
     public void check$sun_net_www_URLConnection$getHeaderFieldKey(Class<?> callerClass, java.net.URLConnection that, int n) {
-        checkEntitlementForURLConnection(callerClass, that);
+        policyChecker.checkEntitlementForURLConnection(callerClass, that);
     }
 
     @Override
     public void check$sun_net_www_URLConnection$getHeaderField(Class<?> callerClass, java.net.URLConnection that, int n) {
-        checkEntitlementForURLConnection(callerClass, that);
+        policyChecker.checkEntitlementForURLConnection(callerClass, that);
     }
 
     @Override
     public void check$sun_net_www_URLConnection$getContentType(Class<?> callerClass, java.net.URLConnection that) {
-        checkEntitlementForURLConnection(callerClass, that);
+        policyChecker.checkEntitlementForURLConnection(callerClass, that);
     }
 
     @Override
     public void check$sun_net_www_URLConnection$getContentLength(Class<?> callerClass, java.net.URLConnection that) {
-        checkEntitlementForURLConnection(callerClass, that);
+        policyChecker.checkEntitlementForURLConnection(callerClass, that);
     }
 
     @Override
@@ -2773,23 +2673,14 @@ public void checkPathRegister(
         policyChecker.checkFileRead(callerClass, that);
     }
 
-    private void checkURLFileRead(Class<?> callerClass, URL url) {
-        try {
-            policyChecker.checkFileRead(callerClass, Paths.get(url.toURI()));
-        } catch (URISyntaxException e) {
-            // We expect this method to be called only on File URLs; otherwise the underlying method would fail anyway
-            throw new RuntimeException(e);
-        }
-    }
-
     @Override
     public void check$sun_net_www_protocol_file_FileURLConnection$connect(Class<?> callerClass, java.net.URLConnection that) {
-        checkURLFileRead(callerClass, that.getURL());
+        policyChecker.checkURLFileRead(callerClass, that.getURL());
     }
 
     @Override
     public void check$sun_net_www_protocol_file_FileURLConnection$getHeaderFields(Class<?> callerClass, java.net.URLConnection that) {
-        checkURLFileRead(callerClass, that.getURL());
+        policyChecker.checkURLFileRead(callerClass, that.getURL());
     }
 
     @Override
@@ -2798,22 +2689,22 @@ private void checkURLFileRead(Class<?> callerClass, URL url) {
         java.net.URLConnection that,
         String name
     ) {
-        checkURLFileRead(callerClass, that.getURL());
+        policyChecker.checkURLFileRead(callerClass, that.getURL());
     }
 
     @Override
     public void check$sun_net_www_protocol_file_FileURLConnection$getHeaderField(Class<?> callerClass, java.net.URLConnection that, int n) {
-        checkURLFileRead(callerClass, that.getURL());
+        policyChecker.checkURLFileRead(callerClass, that.getURL());
     }
 
     @Override
     public void check$sun_net_www_protocol_file_FileURLConnection$getContentLength(Class<?> callerClass, java.net.URLConnection that) {
-        checkURLFileRead(callerClass, that.getURL());
+        policyChecker.checkURLFileRead(callerClass, that.getURL());
     }
 
     @Override
     public void check$sun_net_www_protocol_file_FileURLConnection$getContentLengthLong(Class<?> callerClass, java.net.URLConnection that) {
-        checkURLFileRead(callerClass, that.getURL());
+        policyChecker.checkURLFileRead(callerClass, that.getURL());
     }
 
     @Override
@@ -2822,24 +2713,28 @@ private void checkURLFileRead(Class<?> callerClass, URL url) {
         java.net.URLConnection that,
         int n
     ) {
-        checkURLFileRead(callerClass, that.getURL());
+        policyChecker.checkURLFileRead(callerClass, that.getURL());
     }
 
     @Override
     public void check$sun_net_www_protocol_file_FileURLConnection$getLastModified(Class<?> callerClass, java.net.URLConnection that) {
-        checkURLFileRead(callerClass, that.getURL());
+        policyChecker.checkURLFileRead(callerClass, that.getURL());
     }
 
     @Override
     public void check$sun_net_www_protocol_file_FileURLConnection$getInputStream(Class<?> callerClass, java.net.URLConnection that) {
-        checkURLFileRead(callerClass, that.getURL());
+        policyChecker.checkURLFileRead(callerClass, that.getURL());
     }
 
     @Override
     public void check$java_net_JarURLConnection$getManifest(Class<?> callerClass, java.net.JarURLConnection that) {
         checkJarURLAccess(callerClass, that);
     }
 
+    private void checkJarURLAccess(Class<?> callerClass, JarURLConnection connection) {
+        policyChecker.checkJarURLAccess(callerClass, connection);
+    }
+
     @Override
     public void check$java_net_JarURLConnection$getJarEntry(Class<?> callerClass, java.net.JarURLConnection that) {
         checkJarURLAccess(callerClass, that);