Assert

Author: n1v0lg

server/src/main/java/org/elasticsearch/cluster/metadata/IndexNameExpressionResolver.java

@@ -1031,7 +1031,7 @@ public static String combineSelectorExpression(String baseExpression, @Nullable
             : (baseExpression + SelectorResolver.SELECTOR_SEPARATOR + selectorExpression);
     }
 
-    public static void assertExpressionHasDefaultOrDataSelector(String expression) {
+    public static void assertExpressionHasNullOrDataSelector(String expression) {
         if (Assertions.ENABLED) {
             var tuple = splitSelectorExpression(expression);
             assert tuple.v2() == null || IndexComponentSelector.DATA.getKey().equals(tuple.v2())

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/IndicesPermission.java

@@ -319,7 +319,7 @@ public boolean checkResourcePrivileges(
             combineIndexGroups && checkForIndexPatterns.stream().anyMatch(Automatons::isLuceneRegex)
         );
         for (String forIndexPattern : checkForIndexPatterns) {
-            IndexNameExpressionResolver.assertExpressionHasDefaultOrDataSelector(forIndexPattern);
+            IndexNameExpressionResolver.assertExpressionHasNullOrDataSelector(forIndexPattern);
             Automaton checkIndexAutomaton = Automatons.patterns(forIndexPattern);
             if (false == allowRestrictedIndices && false == isConcreteRestrictedIndex(forIndexPattern)) {
                 checkIndexAutomaton = Automatons.minusAndMinimize(checkIndexAutomaton, restrictedIndices.getAutomaton());

x-pack/plugin/downsample/src/main/java/org/elasticsearch/xpack/downsample/TransportDownsampleAction.java

@@ -210,8 +210,8 @@ protected void masterOperation(
     ) {
         long startTime = client.threadPool().relativeTimeInMillis();
         String sourceIndexName = request.getSourceIndex();
-        IndexNameExpressionResolver.assertExpressionHasDefaultOrDataSelector(sourceIndexName);
-        IndexNameExpressionResolver.assertExpressionHasDefaultOrDataSelector(request.getTargetIndex());
+        IndexNameExpressionResolver.assertExpressionHasNullOrDataSelector(sourceIndexName);
+        IndexNameExpressionResolver.assertExpressionHasNullOrDataSelector(request.getTargetIndex());
         final IndicesAccessControl indicesAccessControl = threadContext.getTransient(AuthorizationServiceField.INDICES_PERMISSIONS_KEY);
         if (indicesAccessControl != null) {
             final IndicesAccessControl.IndexAccessControl indexPermissions = indicesAccessControl.getIndexPermissions(sourceIndexName);

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java

@@ -2211,7 +2211,7 @@ public Function<String, FieldPredicate> getFieldFilter() {
                     return FieldPredicate.ACCEPT_ALL;
                 }
                 assert indicesAccessControl.isGranted();
-                IndexNameExpressionResolver.assertExpressionHasDefaultOrDataSelector(index);
+                IndexNameExpressionResolver.assertExpressionHasNullOrDataSelector(index);
                 IndicesAccessControl.IndexAccessControl indexPermissions = indicesAccessControl.getIndexPermissions(index);
                 if (indexPermissions == null) {
                     return FieldPredicate.ACCEPT_ALL;

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/IndicesAndAliasesResolver.java

@@ -438,6 +438,7 @@ static String getPutMappingIndexOrAlias(
         ProjectMetadata projectMetadata
     ) {
         final String concreteIndexName = request.getConcreteIndex().getName();
+        assert IndexNameExpressionResolver.hasSelectorSuffix(concreteIndexName) == false : "selectors are not allowed in this context";
 
         // validate that the concrete index exists, otherwise there is no remapping that we could do
         final IndexAbstraction indexAbstraction = projectMetadata.getIndicesLookup().get(concreteIndexName);
@@ -464,6 +465,7 @@ static String getPutMappingIndexOrAlias(
             if (aliasMetadata != null) {
                 Optional<String> foundAlias = aliasMetadata.stream().map(AliasMetadata::alias).filter(aliasName -> {
                     // we know this is implicit data access (as opposed to another selector) so the default selector check is correct
+                    assert IndexNameExpressionResolver.hasSelectorSuffix(aliasName) == false : "selectors are not allowed in this context";
                     if (false == isAuthorized.test(aliasName, IndexComponentSelector.DATA)) {
                         return false;
                     }
@@ -511,7 +513,7 @@ private static List<String> replaceWildcardsWithAuthorizedAliases(String[] alias
         }
 
         for (String aliasExpression : aliases) {
-            IndexNameExpressionResolver.assertExpressionHasDefaultOrDataSelector(aliasExpression);
+            IndexNameExpressionResolver.assertExpressionHasNullOrDataSelector(aliasExpression);
             boolean include = true;
             if (aliasExpression.charAt(0) == '-') {
                 include = false;