ES|QL: Disallow brackets in unquoted index patterns

Author: luigidellaquila

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/action/EsqlCapabilities.java

@@ -1215,7 +1215,13 @@ public enum Cap {
         /**
          * (Re)Added EXPLAIN command
          */
-        EXPLAIN(Build.current().isSnapshot());
+        EXPLAIN(Build.current().isSnapshot()),
+
+        /**
+         * Forbid usage of brackets in unquoted index and enrich policy names
+         * https://github.com/elastic/elasticsearch/issues/130378
+         */
+        NO_BRACKETS_IN_UNQUOTED_INDEX_NAMES;
 
         private final boolean enabled;
 

x-pack/plugin/esql/src/test/java/org/elasticsearch/xpack/esql/parser/StatementParserTests.java

@@ -4739,4 +4739,27 @@ public void testUnclosedParenthesis() {
             expectError(q, "Invalid query");
         }
     }
+
+    public void testBracketsInIndexNames() {
+        expectError("from test)", "line 1:10: extraneous input ')' expecting <EOF>");
+
+        expectError("from test | enrich foo)", "line -1:-1: Invalid query [from test | enrich foo)]");
+
+        expectError("from test | lookup join foo) on bar", "line 1:28: token recognition error at: ')'");
+
+        LogicalPlan plan = statement("from \"test)\"");
+        UnresolvedRelation from = as(plan, UnresolvedRelation.class);
+        assertThat(from.indexPattern().indexPattern(), is("test)"));
+
+        plan = statement("from test | enrich \"foo)\"");
+        Enrich enrich = as(plan, Enrich.class);
+        assertThat(enrich.policyName().fold(FoldContext.small()), is(BytesRefs.toBytesRef("foo)")));
+        as(enrich.child(), UnresolvedRelation.class);
+
+        plan = statement("from test | lookup join \"foo)\" on bar");
+        LookupJoin lookup = as(plan, LookupJoin.class);
+        UnresolvedRelation right = as(lookup.right(), UnresolvedRelation.class);
+        assertThat(right.indexPattern().indexPattern(), is("foo)"));
+    }
+
 }

x-pack/plugin/src/yamlRestTest/resources/rest-api-spec/test/esql/220_explain.yml

@@ -86,6 +86,29 @@ explainQuery:
   - match: { values.2.0: "coordinator" }
   - match: { values.2.1: "optimizedPhysicalPlan" }
 
+---
+explainFrom:
+  - do:
+      allowed_warnings_regex:
+        - "No limit defined, adding default limit of \\[.*\\]"
+      esql.query:
+        body:
+          query: 'EXPLAIN (from test)'
+
+  - length: { columns: 3 }
+  - match: {columns.0.name: "role"}
+  - match: {columns.0.type: "keyword"}
+  - match: {columns.1.name: "type"}
+  - match: {columns.1.type: "keyword"}
+  - match: {columns.2.name: "plan"}
+  - match: {columns.2.type: "keyword"}
+  - length: { values: 3 }
+  - match: { values.0.0: "coordinator" }
+  - match: { values.0.1: "parsedPlan" }
+  - match: { values.1.0: "coordinator" }
+  - match: { values.1.1: "optimizedLogicalPlan" }
+  - match: { values.2.0: "coordinator" }
+  - match: { values.2.1: "optimizedPhysicalPlan" }
 
 ---
 explainDownstream:

x-pack/plugin/src/yamlRestTest/resources/rest-api-spec/test/esql/60_enrich.yml

@@ -191,3 +191,59 @@ teardown:
   - match: { values.1: [ "Bob", "New York", "nyc", "USA" ] }
   - match: { values.2: [ "Denise", "Tan Son Nhat", null, null ] }
   - match: { values.3: [ "Mario", "Rome", "rom", "Italy" ] }
+
+
+---
+"Enrich with brackets in policy name":
+  - requires:
+      test_runner_features: [capabilities, allowed_warnings_regex]
+      capabilities:
+        - method: POST
+          path: /_query
+          parameters: []
+          capabilities: [ no_brackets_in_unquoted_index_names ]
+      reason: "Change in the grammar"
+
+  - do:
+      allowed_warnings_regex:
+        - "No limit defined, adding default limit of \\[.*\\]"
+      esql.query:
+        body:
+          query: 'from test | enrich "city_codes_policy)" on city_id | keep name, city, country | sort name'
+      catch: "bad_request"
+
+  - match: { status: 400 }
+  - match: { error.type: verification_exception }
+  - match: { error.reason: "/.*cannot.find.enrich.policy.*/" }
+
+
+---
+"Enrich in fork":
+  - requires:
+      test_runner_features: [capabilities, allowed_warnings_regex]
+      capabilities:
+        - method: POST
+          path: /_query
+          parameters: []
+          capabilities: [ no_brackets_in_unquoted_index_names ]
+      reason: "Change in the grammar"
+
+  - do:
+      allowed_warnings_regex:
+        - "No limit defined, adding default limit of \\[.*\\]"
+      esql.query:
+        body:
+          query: 'from test | eval city_code = city_id | FORK (enrich city_codes_policy) (where false) | keep name, city, country | sort name'
+
+  - match: { columns.0.name: "name" }
+  - match: { columns.0.type: "keyword" }
+  - match: { columns.1.name: "city" }
+  - match: { columns.1.type: "text" }
+  - match: { columns.2.name: "country" }
+  - match: { columns.2.type: "keyword" }
+
+  - length: { values: 4 }
+  - match: { values.0: [ "Alice", "New York", "USA" ] }
+  - match: { values.1: [ "Bob", "New York", "USA" ] }
+  - match: { values.2: [ "Denise", null, null ] }
+  - match: { values.3: [ "Mario", "Rome", "Italy" ] }