Skip to content

Commit 2fe55db

Browse files
authored
Minimize granted and denied fields in FLS (elastic#119453)
Instead of only determinizing, we can minimize the intermediate automata during FLS automaton construction. This brings the codebase back to its original form, before the Lucene 10 upgrade. Follow up to: elastic#119309
1 parent 3534133 commit 2fe55db

File tree

1 file changed

+3
-6
lines changed
  • x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission

1 file changed

+3
-6
lines changed

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/FieldPermissions.java

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
import org.elasticsearch.common.io.stream.StreamOutput;
1919
import org.elasticsearch.common.regex.Regex;
2020
import org.elasticsearch.common.util.CollectionUtils;
21+
import org.elasticsearch.lucene.util.automaton.MinimizationOperations;
2122
import org.elasticsearch.plugins.FieldPredicate;
2223
import org.elasticsearch.xpack.core.security.authz.accesscontrol.FieldSubsetReader;
2324
import org.elasticsearch.xpack.core.security.authz.permission.FieldPermissionsDefinition.FieldGrantExcludeGroup;
@@ -172,12 +173,8 @@ public static Automaton buildPermittedFieldsAutomaton(final String[] grantedFiel
172173
deniedFieldsAutomaton = Automatons.patterns(deniedFields);
173174
}
174175

175-
grantedFieldsAutomaton = Operations.removeDeadStates(
176-
Operations.determinize(grantedFieldsAutomaton, Operations.DEFAULT_DETERMINIZE_WORK_LIMIT)
177-
);
178-
deniedFieldsAutomaton = Operations.removeDeadStates(
179-
Operations.determinize(deniedFieldsAutomaton, Operations.DEFAULT_DETERMINIZE_WORK_LIMIT)
180-
);
176+
grantedFieldsAutomaton = MinimizationOperations.minimize(grantedFieldsAutomaton, Operations.DEFAULT_DETERMINIZE_WORK_LIMIT);
177+
deniedFieldsAutomaton = MinimizationOperations.minimize(deniedFieldsAutomaton, Operations.DEFAULT_DETERMINIZE_WORK_LIMIT);
181178

182179
if (Automatons.subsetOf(deniedFieldsAutomaton, grantedFieldsAutomaton) == false) {
183180
throw new ElasticsearchSecurityException(

0 commit comments

Comments
 (0)