Rethrow NoSuchFileException if encountering an invalid symlink when checking file entitlements #124483
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…hecking file entitlements
elasticsearchmachine
added
v9.1.0
needs:triage
mosche
added
auto-backport
|
Pinging @elastic/es-core-infra (Team:Core/Infra) |
|
The test failure is interesting, in the non modular case |
ldematte
reviewed
Mar 10, 2025
| try { | ||
| checkFileRead(callerClass, path, false); | ||
| } catch (NoSuchFileException e) { | ||
| assert false : "NoSuchFileException should only be thrown when following links"; |
There was a problem hiding this comment.
I think this is the right approach for where we are now; if we go forward with the idea of moving towards exceptions already in the method contract (e.g. IOExceptions for File operations) we will revisit this with all the other methods
...-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/RestEntitlementsCheckAction.java
Outdated
Show resolved
Hide resolved
|
|
||
| // path | ||
| void checkPathToRealPath(Class<?> callerClass, Path that, LinkOption... options); | ||
| void checkPathToRealPath(Class<?> callerClass, Path that, LinkOption... options) throws NoSuchFileException; |
There was a problem hiding this comment.
Possibly for future work: should we add a check that we match the target method's checked exceptions? We would not like to use an incorrect exception type by mistake, it might end up with another "VerifyError"-style problem again.
There was a problem hiding this comment.
IIRC the throws clause doesn't affect bytecode, so it can't cause a verification error. It's only there for javac.
...lement/qa/src/javaRestTest/java/org/elasticsearch/entitlement/qa/AbstractEntitlementsIT.java
Outdated
Show resolved
Hide resolved
mosche
added
the
auto-merge-without-approval
mosche
added a commit
to mosche/elasticsearch
that referenced
this pull request
Mar 11, 2025
…hecking file entitlements (elastic#124483) This will rethrow the `NoSuchFileException` when encountering an invalid symbolic link when following links during file (read) entitlement checks. Relates to elastic#124133 (ES-11019)
mosche
added a commit
to mosche/elasticsearch
that referenced
this pull request
Mar 11, 2025
…hecking file entitlements (elastic#124483) This will rethrow the `NoSuchFileException` when encountering an invalid symbolic link when following links during file (read) entitlement checks. Relates to elastic#124133 (ES-11019)
mosche
added a commit
to mosche/elasticsearch
that referenced
this pull request
Mar 11, 2025
…hecking file entitlements (elastic#124483) This will rethrow the `NoSuchFileException` when encountering an invalid symbolic link when following links during file (read) entitlement checks. Relates to elastic#124133 (ES-11019)
albertzaharovits
pushed a commit
to albertzaharovits/elasticsearch
that referenced
this pull request
Mar 13, 2025
…hecking file entitlements (elastic#124483) This will rethrow the `NoSuchFileException` when encountering an invalid symbolic link when following links during file (read) entitlement checks. Relates to elastic#124133 (ES-11019)
jfreden
pushed a commit
to jfreden/elasticsearch
that referenced
this pull request
Mar 13, 2025
…hecking file entitlements (elastic#124483) This will rethrow the `NoSuchFileException` when encountering an invalid symbolic link when following links during file (read) entitlement checks. Relates to elastic#124133 (ES-11019)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This will rethrow the
NoSuchFileExceptionwhen encountering an invalid symbolic link when following links during file (read) entitlement checks.Relates to #124133 (ES-11019)