[Entitlements] Add URLConnection instrumentation for file protocol

[ldematte]

Based on #123503

Relates to ES-10994

[ldematte]

Would it be better/safer to use url.getFile() here instead?

[ldematte]

@rjernst I'd like your input here, wdyt? Is it OK as is, or is using url.getFile() better?

[ldematte]

The idea behind the current implementation is that if we are getting the URL from a FileURLConnection, so the URL must be a valid File URL already; and even if we are give an invalid File URL, the method we are instrumenting would eventually fail anyway, so we don't care about re-throwing the exception.

The idea behind using url.getFile() instead is that this does not throw; it simply returns a (possibly invalid) String, that we will use to create a Path and then pass to the PolicyManager/FileAccessTree (which will do a string-matching check, so we don't really care if it's valid or not). While cratering a Path we can still get a InvalidPathException, but that is much more unlikely (there are just a bunch of character that cannot be in a path in the various OSes).

An third alternative is to catch the syntax exception and re-throw a NotEntitledException, much like I want to do with the next PR (Jar) once we cover all the protocols we want to cover: in case we "see" a different protocol, or in general some unknown URL (not file, not network), we block it (see

elasticsearch/libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/api/ElasticsearchEntitlementChecker.java

Line 685 in a407e99

private void checkEntitlementForUrl(Class<?> callerClass, URL that) {

)

[rjernst]

I believe what you have (using Paths.get on the uri) is the correct way. It's what we do in other places, eg in JarHell.

[rjernst]

You might be right that trying to get the path out of the URL directly can work without needing to catch exceptions, though it should be getPath() instead (see the docs on getFile(), it can contain query stuff as well).

[ldematte]

Thanks Ryan. I'll keep Paths for now, and make a mental note to use getPath() if I spot anything even remotely suspicious.

[elasticsearchmachine]

Pinging @elastic/es-core-infra (Team:Core/Infra)

[prdoyle]

This withXxx style makes the test cases really easy to review!

[elasticsearchmachine]

💔 Backport failed

Status	Branch	Result
❌	8.18	Commit could not be cherrypicked due to conflicts
❌	8.x	Commit could not be cherrypicked due to conflicts
✅	9.0

You can use sqren/backport to manually backport by running backport --upstream elastic/elasticsearch --pr 123824