Merge branch 'main' into feature/multi-project/health-dlm

Author: samxbr

build-tools-internal/version.properties

@@ -38,8 +38,8 @@ protobuf          = 3.25.5
 # test dependencies
 randomizedrunner  = 2.8.2
 junit             = 4.13.2
-junit5            = 5.7.1
-hamcrest          = 2.1
+junit5            = 5.12.1
+hamcrest          = 3.0
 mocksocket        = 1.2
 
 # test container dependencies

docs/reference/search-connectors/es-postgresql-connector-client-tutorial.md

@@ -2,6 +2,7 @@
 navigation_title: "Tutorial"
 mapped_pages:
   - https://www.elastic.co/guide/en/elasticsearch/reference/current/es-postgresql-connector-client-tutorial.html
+  - https://www.elastic.co/guide/en/starting-with-the-elasticsearch-platform-and-its-solutions/current/getting-started-appsearch.html
 ---
 
 # PostgreSQL self-managed connector tutorial [es-postgresql-connector-client-tutorial]

gradle/build.versions.toml

@@ -1,7 +1,7 @@
 [versions]
 asm = "9.7.1"
 jackson = "2.15.0"
-junit5 = "5.8.1"
+junit5 = "5.12.1"
 spock = "2.1-groovy-3.0"
 
 [libraries]
@@ -17,7 +17,7 @@ commmons-io = "commons-io:commons-io:2.2"
 docker-compose = "com.avast.gradle:gradle-docker-compose-plugin:0.17.5"
 forbiddenApis = "de.thetaphi:forbiddenapis:3.8"
 gradle-enterprise = "com.gradle:develocity-gradle-plugin:3.19.2"
-hamcrest = "org.hamcrest:hamcrest:2.1"
+hamcrest = "org.hamcrest:hamcrest:3.0"
 httpcore5 = "org.apache.httpcomponents.core5:httpcore5:5.3.3"
 httpclient5 = "org.apache.httpcomponents.client5:httpclient5:5.4.2"
 idea-ext = "gradle.plugin.org.jetbrains.gradle.plugin.idea-ext:gradle-idea-ext:1.1.4"

gradle/verification-metadata.xml

@@ -1634,16 +1634,6 @@
             <sha256 value="d65b4f127d36cf52b9b7b439552db22f3de92b892014512870cb3c98a3cf505e" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="junit" name="junit" version="3.8.1">
-         <artifact name="junit-3.8.1.jar">
-            <sha256 value="b58e459509e190bed737f3592bc1950485322846cf10e78ded1d065153012d70" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
-      <component group="junit" name="junit" version="4.12">
-         <artifact name="junit-4.12.jar">
-            <sha256 value="59721f0805e223d84b90677887d9ff567dc534d7c502ca903c0c2b17f05c116a" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
       <component group="junit" name="junit" version="4.13.2">
          <artifact name="junit-4.13.2.jar">
             <sha256 value="8e495b634469d64fb8acfa3495a065cbacc8a0fff55ce1e31007be4c16dc57d3" origin="Generated by Gradle"/>
@@ -3317,6 +3307,11 @@
             <sha256 value="d749db58c2bd353f1c03541d747b753931d4b84da8e48993ef51efe8694b4ed7" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.assertj" name="assertj-core" version="3.27.3">
+         <artifact name="assertj-core-3.27.3.jar">
+            <sha256 value="5b8a26205f6d5ea60ad9ce65ce4a40a2afe4c48abeec61bd0740a088c24e89f5" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.bouncycastle" name="bc-fips" version="1.0.2.5">
          <artifact name="bc-fips-1.0.2.5.jar">
             <sha256 value="50e4c7a0d0c68413d3d8587560d56945ac09e7c89c41bd971cd22d76be6f1085" origin="Generated by Gradle"/>
@@ -3887,16 +3882,16 @@
             <sha256 value="54045988848801e84cffd604cfd94f6e2a613248d81ca315c20e74d0ac3b602c" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="org.hamcrest" name="hamcrest" version="2.1">
-         <artifact name="hamcrest-2.1.jar">
-            <sha256 value="ba93b2e3a562322ba432f0a1b53addcc55cb188253319a020ed77f824e692050" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
       <component group="org.hamcrest" name="hamcrest" version="2.2">
          <artifact name="hamcrest-2.2.jar">
             <sha256 value="5e62846a89f05cd78cd9c1a553f340d002458380c320455dd1f8fc5497a8a1c1" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.hamcrest" name="hamcrest" version="3.0">
+         <artifact name="hamcrest-3.0.jar">
+            <sha256 value="5d66b6a4a680755cb6ed7cb104fa7835ef644667586ff0737adeb977c39ecdbc" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.hamcrest" name="hamcrest-core" version="1.3">
          <artifact name="hamcrest-core-1.3.jar">
             <sha256 value="66fdef91e9739348df7a096aa384a5685f4e875584cce89386a7a47251c4d8e9" origin="Generated by Gradle"/>
@@ -4007,49 +4002,74 @@
             <sha256 value="e2b99c0d2fa39f69f27efb1c0016390713feb2f2e02d8ea7f1c36b780271598a" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.junit.jupiter" name="junit-jupiter" version="5.12.1">
+         <artifact name="junit-jupiter-5.12.1.jar">
+            <sha256 value="228a94c9ee743d55bfea09b57630681ea7b20a661a477447f5c1f60dc12d9e3a" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.junit.jupiter" name="junit-jupiter" version="5.8.1">
          <artifact name="junit-jupiter-5.8.1.jar">
             <sha256 value="8f1049ee24b34a10b60cd810048099f781c2658cde2181e831496ab30a982985" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="org.junit.jupiter" name="junit-jupiter-api" version="5.8.1">
-         <artifact name="junit-jupiter-api-5.8.1.jar">
-            <sha256 value="ce3374a7efba605e2d2b69a3fef90134032bab3ecc3ed8579a4871b1c2c4729c" origin="Generated by Gradle"/>
+      <component group="org.junit.jupiter" name="junit-jupiter-api" version="5.12.1">
+         <artifact name="junit-jupiter-api-5.12.1.jar">
+            <sha256 value="a401e0b60373edf7df0962c25eb3213e451a4778792d33a76876c3b8a5bb209b" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
+      <component group="org.junit.jupiter" name="junit-jupiter-engine" version="5.12.1">
+         <artifact name="junit-jupiter-engine-5.12.1.jar">
+            <sha256 value="0e7f2dbeb91bfaeb0d4cb33a487351baf0e5a6ed72906154d8fd9975d329c592" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="org.junit.jupiter" name="junit-jupiter-engine" version="5.8.1">
-         <artifact name="junit-jupiter-engine-5.8.1.jar">
-            <sha256 value="4689bc902255a19fe98277683ba3231c094d107c54c8d35f2b6f9c97d226418e" origin="Generated by Gradle"/>
+      <component group="org.junit.jupiter" name="junit-jupiter-params" version="5.12.1">
+         <artifact name="junit-jupiter-params-5.12.1.jar">
+            <sha256 value="5951706999e35951d4df0eca6e091d3619f659a9c10858f2f5a3ce191cb57673" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="org.junit.jupiter" name="junit-jupiter-params" version="5.8.1">
-         <artifact name="junit-jupiter-params-5.8.1.jar">
-            <sha256 value="389b8d13a8d8872fcbd4f0eba7b2c46afc628419f9a1b2a3a9f93241a06a7218" origin="Generated by Gradle"/>
+      <component group="org.junit.platform" name="junit-platform-commons" version="1.12.1">
+         <artifact name="junit-platform-commons-1.12.1.jar">
+            <sha256 value="c316163581aaa5649280122b12ea36fe4e9c202a1a2267753fea7c9e1df055eb" origin="Generated by Gradle"/>
          </artifact>
       </component>
       <component group="org.junit.platform" name="junit-platform-commons" version="1.8.1">
          <artifact name="junit-platform-commons-1.8.1.jar">
             <sha256 value="fa4fa68c8bd54dd0cb49c3fcbe9b2e42f4da6bedbe7e7ccf2a05f1a1e609b593" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.junit.platform" name="junit-platform-engine" version="1.12.1">
+         <artifact name="junit-platform-engine-1.12.1.jar">
+            <sha256 value="7fedff93fd92aec7d29fc60dc01fa027246b36b8088423a5efc4949e5f6affa4" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.junit.platform" name="junit-platform-engine" version="1.8.1">
          <artifact name="junit-platform-engine-1.8.1.jar">
             <sha256 value="702868ed7e86b9b4672ede0f1e185e905baca9afab57746a7c650be3c7bca047" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.junit.platform" name="junit-platform-launcher" version="1.12.1">
+         <artifact name="junit-platform-launcher-1.12.1.jar">
+            <sha256 value="ebbb14e7b29f60730eaede862ed69d7de0d581ea0c038fa6a202955c7541f525" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.junit.platform" name="junit-platform-launcher" version="1.8.1">
          <artifact name="junit-platform-launcher-1.8.1.jar">
             <sha256 value="83a9ed68adcb76e60316a4d682fc48507865df2f0ab35f82695cc9995410e05e" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.junit.platform" name="junit-platform-testkit" version="1.12.1">
+         <artifact name="junit-platform-testkit-1.12.1.jar">
+            <sha256 value="40623b54782410e0855c543e0ff150d221ed3f77ed75693d66710640ec2271be" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.junit.platform" name="junit-platform-testkit" version="1.8.1">
          <artifact name="junit-platform-testkit-1.8.1.jar">
             <sha256 value="38d6b8bdd3e5de159564bf33bd8918ce24baca57a84f1ea743f0074e4819e697" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="org.junit.vintage" name="junit-vintage-engine" version="5.8.1">
-         <artifact name="junit-vintage-engine-5.8.1.jar">
-            <sha256 value="176b53cd1bdbf9233e96c8b0c7a9e5b864282fbbdeba43b5ceafdedb29a49156" origin="Generated by Gradle"/>
+      <component group="org.junit.vintage" name="junit-vintage-engine" version="5.12.1">
+         <artifact name="junit-vintage-engine-5.12.1.jar">
+            <sha256 value="9b93fb605b9fa0b750a69212a0141eb648c6c90f3b7f2c48dd8cdd2b72513109" origin="Generated by Gradle"/>
          </artifact>
       </component>
       <component group="org.locationtech.jts" name="jts-core" version="1.15.0">
@@ -4292,6 +4312,11 @@
             <sha256 value="58812de60898d976fb81ef3b62da05c6604c18fd4a249f5044282479fc286af2" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.opentest4j" name="opentest4j" version="1.3.0">
+         <artifact name="opentest4j-1.3.0.jar">
+            <sha256 value="48e2df636cab6563ced64dcdff8abb2355627cb236ef0bf37598682ddf742f1b" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.orbisgis" name="cts" version="1.5.2">
          <artifact name="cts-1.5.2.jar">
             <sha256 value="72f8b1fbb59fe777dd1cbd618d39e22ab28436fa0843979c6120bd6cd5833e0e" origin="Generated by Gradle"/>

libs/entitlement/asm-provider/src/main/java/org/elasticsearch/entitlement/instrumentation/impl/InstrumenterImpl.java

@@ -37,10 +37,8 @@
 import static org.objectweb.asm.ClassWriter.COMPUTE_FRAMES;
 import static org.objectweb.asm.ClassWriter.COMPUTE_MAXS;
 import static org.objectweb.asm.Opcodes.ACC_STATIC;
-import static org.objectweb.asm.Opcodes.GETSTATIC;
 import static org.objectweb.asm.Opcodes.INVOKEINTERFACE;
 import static org.objectweb.asm.Opcodes.INVOKESTATIC;
-import static org.objectweb.asm.Opcodes.INVOKEVIRTUAL;
 
 public class InstrumenterImpl implements Instrumenter {
     private static final Logger logger = LogManager.getLogger(InstrumenterImpl.class);
@@ -286,22 +284,9 @@ private void pushCallerClass() {
                     false
                 );
             } else {
-                mv.visitFieldInsn(
-                    GETSTATIC,
-                    Type.getInternalName(StackWalker.Option.class),
-                    "RETAIN_CLASS_REFERENCE",
-                    Type.getDescriptor(StackWalker.Option.class)
-                );
                 mv.visitMethodInsn(
                     INVOKESTATIC,
-                    Type.getInternalName(StackWalker.class),
-                    "getInstance",
-                    Type.getMethodDescriptor(Type.getType(StackWalker.class), Type.getType(StackWalker.Option.class)),
-                    false
-                );
-                mv.visitMethodInsn(
-                    INVOKEVIRTUAL,
-                    Type.getInternalName(StackWalker.class),
+                    "org/elasticsearch/entitlement/bridge/Util",
                     "getCallerClass",
                     Type.getMethodDescriptor(Type.getType(Class.class)),
                     false

libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementCheckerHandle.java

@@ -18,6 +18,7 @@ public class EntitlementCheckerHandle {
      * This is how the bytecodes injected by our instrumentation access the {@link EntitlementChecker}
      * so they can call the appropriate check method.
      */
+    @SuppressWarnings("unused")
     public static EntitlementChecker instance() {
         return Holder.instance;
     }

libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/Util.java

@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+package org.elasticsearch.entitlement.bridge;
+
+import java.util.Optional;
+
+import static java.lang.StackWalker.Option.RETAIN_CLASS_REFERENCE;
+
+public class Util {
+    /**
+     * A special value representing the case where a method <em>has no caller</em>.
+     * This can occur if it's called directly from the JVM.
+     *
+     * @see StackWalker#getCallerClass()
+     */
+    public static final Class<?> NO_CLASS = new Object() {
+    }.getClass();
+
+    /**
+     * Why would we write this instead of using {@link StackWalker#getCallerClass()}?
+     * Because that method throws {@link IllegalCallerException} if called from the "outermost frame",
+     * which includes at least some cases of a method called from a native frame.
+     *
+     * @return the class that called the method which called this; or {@link #NO_CLASS} from the outermost frame.
+     */
+    @SuppressWarnings("unused") // Called reflectively from InstrumenterImpl
+    public static Class<?> getCallerClass() {
+        Optional<Class<?>> callerClassIfAny = StackWalker.getInstance(RETAIN_CLASS_REFERENCE)
+            .walk(
+                frames -> frames.skip(2) // Skip this method and its caller
+                    .findFirst()
+                    .map(StackWalker.StackFrame::getDeclaringClass)
+            );
+        return callerClassIfAny.orElse(NO_CLASS);
+    }
+
+}

libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyManager.java

@@ -57,6 +57,7 @@
 import static java.util.stream.Collectors.toUnmodifiableMap;
 import static java.util.zip.ZipFile.OPEN_DELETE;
 import static java.util.zip.ZipFile.OPEN_READ;
+import static org.elasticsearch.entitlement.bridge.Util.NO_CLASS;
 
 public class PolicyManager {
     /**
@@ -712,8 +713,6 @@ Class<?> requestingClass(Class<?> callerClass) {
 
     /**
      * Given a stream of {@link StackFrame}s, identify the one whose entitlements should be checked.
-     *
-     * @throws NullPointerException if the requesting module is {@code null}
      */
     Optional<StackFrame> findRequestingFrame(Stream<StackFrame> frames) {
         return frames.filter(f -> f.getDeclaringClass().getModule() != entitlementsModule) // ignore entitlements library
@@ -732,6 +731,10 @@ private static boolean isTriviallyAllowed(Class<?> requestingClass) {
             generalLogger.debug("Entitlement trivially allowed: no caller frames outside the entitlement library");
             return true;
         }
+        if (requestingClass == NO_CLASS) {
+            generalLogger.debug("Entitlement trivially allowed from outermost frame");
+            return true;
+        }
         if (SYSTEM_LAYER_MODULES.contains(requestingClass.getModule())) {
             generalLogger.debug("Entitlement trivially allowed from system module [{}]", requestingClass.getModule().getName());
             return true;

libs/entitlement/src/test/java/org/elasticsearch/entitlement/bridge/UtilTests.java

@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+package org.elasticsearch.entitlement.bridge;
+
+import org.elasticsearch.test.ESTestCase;
+
+import static org.elasticsearch.entitlement.bridge.UtilTests.MockSensitiveClass.mockSensitiveMethod;
+
+@ESTestCase.WithoutSecurityManager
+public class UtilTests extends ESTestCase {
+
+    public void testCallerClass() {
+        assertEquals(UtilTests.class, mockSensitiveMethod());
+    }
+
+    /**
+     * A separate class so the stack walk can discern the sensitive method's own class
+     * from that of its caller.
+     */
+    static class MockSensitiveClass {
+        public static Class<?> mockSensitiveMethod() {
+            return Util.getCallerClass();
+        }
+    }
+
+}

modules/lang-painless/src/main/java/org/elasticsearch/painless/phase/DefaultUserTreeToIRTreePhase.java

@@ -15,7 +15,6 @@
 import org.elasticsearch.painless.Location;
 import org.elasticsearch.painless.MethodWriter;
 import org.elasticsearch.painless.Operation;
-import org.elasticsearch.painless.WriterConstants;
 import org.elasticsearch.painless.api.ValueIterator;
 import org.elasticsearch.painless.ir.BinaryImplNode;
 import org.elasticsearch.painless.ir.BinaryMathNode;
@@ -913,10 +912,6 @@ public void visitAssignment(EAssignment userAssignmentNode, ScriptScope scriptSc
                 stringConcatenationNode.attachDecoration(new IRDExpressionType(String.class));
                 irCompoundNode = stringConcatenationNode;
 
-                // must handle the StringBuilder case for java version <= 8
-                if (irLoadNode instanceof BinaryImplNode bin && WriterConstants.STRING_CONCAT_BOOTSTRAP_HANDLE == null) {
-                    bin.getLeftNode().attachDecoration(new IRDDepth(1));
-                }
                 // handles when the operation is mathematical
             } else {
                 BinaryMathNode irBinaryMathNode = new BinaryMathNode(irStoreNode.getLocation());