Add New Security Script Settings #24637
Conversation
jdconrad
added
:Core/Infra/Scripting
|
@elasticmachine please test this |
|
@rjernst If you're feeling up to it, I would appreciate a review on this :) |
|
|
||
| /** | ||
| * @return <tt>true</tt> if the provided {@link ScriptContext} is supported, <tt>false</tt> otherwise | ||
| */ | ||
| boolean isSupportedContext(ScriptContext scriptContext) { |
There was a problem hiding this comment.
Can we change the callers of isSupportedContext to call getKey() so there is only one variant of this method?
There was a problem hiding this comment.
Done. There were only two callers and one was a test.
| HashMap<String, Boolean> scriptModes = new HashMap<>(); | ||
| for (Setting<Boolean> scriptModeSetting : scriptSettings.getScriptLanguageSettings()) { | ||
| scriptModes.put(scriptModeSetting.getKey(), scriptModeSetting.get(settings)); | ||
| } | ||
| this.scriptEnabled = Collections.unmodifiableMap(scriptModes); | ||
|
|
||
| typesAllowed = TYPES_ALLOWED_SETTING.exists(settings) ? new HashSet<>() : null; |
There was a problem hiding this comment.
I think in the future we can simplify this a bit, so the Setting value is not a List, but that can be in future work as I know this class will probably go away in master with context work.
There was a problem hiding this comment.
Agree completely on this.
| [float] | ||
| === Allowed script types setting | ||
|
|
||
| By default all script types are allowed to be executed. This can modified using the |
| === Allowed script types setting | ||
|
|
||
| By default all script types are allowed to be executed. This can modified using the | ||
| setting `script.allowed_types`. Should this setting be used, only the types specified |
There was a problem hiding this comment.
I think you can remove the "Should this setting be used" part.
|
@rjernst Thanks for the review! As soon as the CI build passes I will commit. |
Settings are simplified to allowed_types and allowed_contexts. If a setting is not specified the default is to enable all for that setting.
Adds allowed_types and allowed_contexts as new security settings for scripts described in detail in the issue #24532.
Closes #24532