Create Security Role API allows malformed/invalid query JSON #34252
Assignees
Labels
Comments
|
Pinging @elastic/es-security |
bizybot
pushed a commit
to bizybot/elasticsearch
that referenced
this issue
Sep 5, 2019
As of now the validation occurs at runtime when the query is being executed. I think the reason was due to the use of template queries which need runtime information as they need to be evaluated like user information. This commit adds validation for the role query but **not for the template query** as we do not have the runtime information required for evaluating the template query. This also corrects some tests and roles.yml files where the `query` field was not populated correctly. For validation, the query is evaluated (if not a template), parsed to build the `QueryBuilder` and verify if the query type is allowed. Closes elastic#34252
bizybot
added a commit
that referenced
this issue
Sep 25, 2019
In the current implementation, the validation of the role query occurs at runtime when the query is being executed. This commit adds validation for the role query when creating a role but not for the template query as we do not have the runtime information required for evaluating the template query (eg. authenticated user's information). This is similar to the scripts that we store but do not evaluate or parse if they are valid queries or not. For validation, the query is evaluated (if not a template), parsed to build the QueryBuilder and verify if the query type is allowed. Closes #34252
bizybot
added a commit
to bizybot/elasticsearch
that referenced
this issue
Sep 25, 2019
In the current implementation, the validation of the role query occurs at runtime when the query is being executed. This commit adds validation for the role query when creating a role but not for the template query as we do not have the runtime information required for evaluating the template query (eg. authenticated user's information). This is similar to the scripts that we store but do not evaluate or parse if they are valid queries or not. For validation, the query is evaluated (if not a template), parsed to build the QueryBuilder and verify if the query type is allowed. Closes elastic#34252
bizybot
added a commit
that referenced
this issue
Sep 26, 2019
In the current implementation, the validation of the role query occurs at runtime when the query is being executed. This commit adds validation for the role query when creating a role but not for the template query as we do not have the runtime information required for evaluating the template query (eg. authenticated user's information). This is similar to the scripts that we store but do not evaluate or parse if they are valid queries or not. For validation, the query is evaluated (if not a template), parsed to build the QueryBuilder and verify if the query type is allowed. Closes #34252
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Elasticsearch version (
bin/elasticsearch --version):Version: 6.4.1, Build: default/tar/e36acdb/2018-09-13T22:18:07.696808Z, JVM: 10.0.1Version: 6.3.0, Build: default/tar/424e937/2018-06-11T23:38:03.357887Z, JVM: 10.0.1Plugins installed: []
JVM version (
java -version):OS version (
uname -aif on a Unix-like system):Description of the problem including expected versus actual behavior:
The Create or update roles API will allow defining a malformed/invalid query JSON in it's
queryattribute definition. Any query that is executed by a user with a role that has a malformed/invalid JSON inqueryattribute will always fail.The expected is that the attempt to create a role should always fail if it defines a malformed/invalid JSON in it's
queryattribute.Additionally, the same is observed if a
queryattribute is defined with a correct JSON syntax but it's an invalid/unknown Elasticsearch query .Note: This has been observed both in
6.3.0and6.4.1Steps to reproduce:
queryattribute:Elasticsearch will accept the role definition and respond with:
{ "role": { "created": true } }test. The search will fail since the resulting query is invalid:$ curl -u test:123456 localhost:9200/test-1/_search {"error":{"root_cause":[{"type":"exception","reason":"com.fasterxml.jackson.core.JsonParseException: Unexpected character ('m' (code 109)): was expecting double-quote to start field name\n at [Source: java.io.StringReader@49bcb51e; line: 1, column: 4]"},{"type":"exception","reason":"com.fasterxml.jackson.core.JsonParseException: Unexpected character ('m' (code 109)): was expecting double-quote to start field name\n at [Source: java.io.StringReader@52014fcf; line: 1, column: 4]"},{"type":"exception","reason":"com.fasterxml.jackson.core.JsonParseException: Unexpected character ('m' (code 109)): was expecting double-quote to start field name\n at [Source: java.io.StringReader@56e9f409; line: 1, column: 4]"},{"type":"exception","reason":"com.fasterxml.jackson.core.JsonParseException: Unexpected character ('m' (code 109)): was expecting double-quote to start field name\n at [Source: java.io.StringReader@34d339df; line: 1, column: 4]"},{"type":"exception","reason":"com.fasterxml.jackson.core.JsonParseException: Unexpected character ('m' (code 109)): was expecting double-quote to start field name\n at [Source: java.io.StringReader@32068a2e; line: 1, column: 4]"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"test-1","node":"tZDWdiboSy2tuPtyrL4nUQ","reason":{"type":"exception","reason":"com.fasterxml.jackson.core.JsonParseException: Unexpected character ('m' (code 109)): was expecting double-quote to start field name\n at [Source: java.io.StringReader@49bcb51e; line: 1, column: 4]","caused_by":{"type":"json_parse_exception","reason":"Unexpected character ('m' (code 109)): was expecting double-quote to start field name\n at [Source: java.io.StringReader@49bcb51e; line: 1, column: 4]"}}},{"shard":1,"index":"test-1","node":"tZDWdiboSy2tuPtyrL4nUQ","reason":{"type":"exception","reason":"com.fasterxml.jackson.core.JsonParseException: Unexpected character ('m' (code 109)): was expecting double-quote to start field name\n at [Source: java.io.StringReader@52014fcf; line: 1, column: 4]","caused_by":{"type":"json_parse_exception","reason":"Unexpected character ('m' (code 109)): was expecting double-quote to start field name\n at [Source: java.io.StringReader@52014fcf; line: 1, column: 4]"}}},{"shard":2,"index":"test-1","node":"tZDWdiboSy2tuPtyrL4nUQ","reason":{"type":"exception","reason":"com.fasterxml.jackson.core.JsonParseException: Unexpected character ('m' (code 109)): was expecting double-quote to start field name\n at [Source: java.io.StringReader@56e9f409; line: 1, column: 4]","caused_by":{"type":"json_parse_exception","reason":"Unexpected character ('m' (code 109)): was expecting double-quote to start field name\n at [Source: java.io.StringReader@56e9f409; line: 1, column: 4]"}}},{"shard":3,"index":"test-1","node":"tZDWdiboSy2tuPtyrL4nUQ","reason":{"type":"exception","reason":"com.fasterxml.jackson.core.JsonParseException: Unexpected character ('m' (code 109)): was expecting double-quote to start field name\n at [Source: java.io.StringReader@34d339df; line: 1, column: 4]","caused_by":{"type":"json_parse_exception","reason":"Unexpected character ('m' (code 109)): was expecting double-quote to start field name\n at [Source: java.io.StringReader@34d339df; line: 1, column: 4]"}}},{"shard":4,"index":"test-1","node":"tZDWdiboSy2tuPtyrL4nUQ","reason":{"type":"exception","reason":"com.fasterxml.jackson.core.JsonParseException: Unexpected character ('m' (code 109)): was expecting double-quote to start field name\n at [Source: java.io.StringReader@32068a2e; line: 1, column: 4]","caused_by":{"type":"json_parse_exception","reason":"Unexpected character ('m' (code 109)): was expecting double-quote to start field name\n at [Source: java.io.StringReader@32068a2e; line: 1, column: 4]"}}}]},"status":500}Provide logs (if relevant):
The text was updated successfully, but these errors were encountered: