Entitlement policies correct handling of prefixes that are not directories

libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/FileAccessTree.java

@@ -12,6 +12,7 @@
 import org.elasticsearch.entitlement.runtime.policy.entitlements.FileEntitlement;
 
 import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
@@ -27,11 +28,11 @@ private FileAccessTree(List<FileEntitlement> fileEntitlements) {
         List<String> readPaths = new ArrayList<>();
         List<String> writePaths = new ArrayList<>();
         for (FileEntitlement fileEntitlement : fileEntitlements) {
-            var mode = fileEntitlement.mode();
-            if (mode == FileEntitlement.Mode.READ_WRITE) {
-                writePaths.add(fileEntitlement.path());
+            String path = normalizedPath(fileEntitlement);
+            if (fileEntitlement.mode() == FileEntitlement.Mode.READ_WRITE) {
+                writePaths.add(path);
             }
-            readPaths.add(fileEntitlement.path());
+            readPaths.add(path);
         }
 
         readPaths.sort(String::compareTo);
@@ -53,8 +54,12 @@ boolean canWrite(Path path) {
         return checkPath(normalize(path), writePaths);
     }
 
+    private static String normalizedPath(FileEntitlement fileEntitlement) {
+        return normalize(Paths.get(fileEntitlement.path()));
+    }
+
     private static String normalize(Path path) {
-        return path.toAbsolutePath().normalize().toString();
+        return path.toAbsolutePath().normalize().toString().replace('\\', '/');
     }
 
     private static boolean checkPath(String path, String[] paths) {
@@ -64,7 +69,7 @@ private static boolean checkPath(String path, String[] paths) {
         int ndx = Arrays.binarySearch(paths, path);
         if (ndx < -1) {
             String maybeParent = paths[-ndx - 2];
-            return path.startsWith(maybeParent);
+            return path.startsWith(maybeParent) && path.charAt(maybeParent.length()) == '/';
         }
         return ndx >= 0;
     }

libs/entitlement/src/test/java/org/elasticsearch/entitlement/runtime/policy/FileAccessTreeTests.java

@@ -41,7 +41,9 @@ public void testRead() {
         var tree = FileAccessTree.of(List.of(entitlement("foo", "read")));
         assertThat(tree.canRead(path("foo")), is(true));
         assertThat(tree.canRead(path("foo/subdir")), is(true));
+        assertThat(tree.canRead(path("food")), is(false));
         assertThat(tree.canWrite(path("foo")), is(false));
+        assertThat(tree.canWrite(path("food")), is(false));
 
         assertThat(tree.canRead(path("before")), is(false));
         assertThat(tree.canRead(path("later")), is(false));
@@ -51,7 +53,9 @@ public void testWrite() {
         var tree = FileAccessTree.of(List.of(entitlement("foo", "read_write")));
         assertThat(tree.canWrite(path("foo")), is(true));
         assertThat(tree.canWrite(path("foo/subdir")), is(true));
+        assertThat(tree.canWrite(path("food")), is(false));
         assertThat(tree.canRead(path("foo")), is(true));
+        assertThat(tree.canRead(path("food")), is(false));
 
         assertThat(tree.canWrite(path("before")), is(false));
         assertThat(tree.canWrite(path("later")), is(false));
@@ -83,6 +87,17 @@ public void testNormalizePath() {
         assertThat(tree.canRead(path("")), is(false));
     }
 
+    public void testSlashesAreInterchangeable() {
+        var tree = FileAccessTree.of(List.of(entitlement("a/b", "read"), entitlement("m\\n", "read")));
+        assertThat(tree.canRead(path("a/b")), is(true));
+        assertThat(tree.canRead(path("a\\b")), is(true));
+        assertThat(tree.canRead(path("m/n")), is(true));
+        assertThat(tree.canRead(path("m\\n")), is(true));
+
+        // Backslash shouldn't be treated as an escape
+        assertThat(tree.canRead(path("m\n")), is(false));
+    }
+
     FileEntitlement entitlement(String path, String mode) {
         Path p = path(path);
         return new FileEntitlement(p.toString(), mode);