Merge pull request #12451 from jasontedor/fix/12382

Add explicit check that we have reached the end of the settings stream when parsing settings

core/src/main/java/org/elasticsearch/common/settings/loader/XContentSettingsLoader.java

@@ -20,6 +20,7 @@
 package org.elasticsearch.common.settings.loader;
 
 import org.elasticsearch.ElasticsearchParseException;
+import org.elasticsearch.common.xcontent.XContent;
 import org.elasticsearch.common.xcontent.XContentFactory;
 import org.elasticsearch.common.xcontent.XContentParser;
 import org.elasticsearch.common.xcontent.XContentType;
@@ -65,6 +66,23 @@ public abstract class XContentSettingsLoader implements SettingsLoader {
             throw new ElasticsearchParseException("malformed, expected settings to start with 'object', instead was [{}]", token);
         }
         serializeObject(settings, sb, path, jp, null);
+
+        // ensure we reached the end of the stream
+        Exception exception = null;
+        XContentParser.Token lastToken = null;
+        try {
+            while (!jp.isClosed() && (lastToken = jp.nextToken()) == null);
+        } catch (Exception e) {
+            exception = e;
+        }
+        if (exception != null || lastToken != null) {
+            throw new ElasticsearchParseException(
+                    "malformed, expected end of settings but encountered additional content starting at columnNumber: [{}], lineNumber: [{}]",
+                    jp.getTokenLocation().columnNumber,
+                    jp.getTokenLocation().lineNumber
+            );
+        }
+
         return settings;
     }
 

core/src/main/java/org/elasticsearch/common/xcontent/XContentParser.java

@@ -250,4 +250,6 @@ public interface XContentParser extends Releasable {
      * @return last token's location or null if cannot be determined
      */
     XContentLocation getTokenLocation();
+
+    boolean isClosed();
 }

core/src/main/java/org/elasticsearch/common/xcontent/json/JsonXContentParser.java

@@ -248,4 +248,9 @@ public class JsonXContentParser extends AbstractXContentParser {
         }
         throw new IllegalStateException("No matching token for json_token [" + token + "]");
     }
+
+    @Override
+    public boolean isClosed() {
+        return parser.isClosed();
+    }
 }

core/src/main/java/org/elasticsearch/common/xcontent/support/AbstractXContentParser.java

@@ -319,4 +319,7 @@ public abstract class AbstractXContentParser implements XContentParser {
         }
         return null;
     }
+
+    @Override
+    public abstract boolean isClosed();
 }

core/src/test/java/org/elasticsearch/common/settings/loader/YamlSettingsLoaderTests.java

@@ -20,11 +20,11 @@
 package org.elasticsearch.common.settings.loader;
 
 import org.elasticsearch.common.settings.Settings;
+import org.elasticsearch.common.settings.SettingsException;
 import org.elasticsearch.test.ElasticsearchTestCase;
 import org.junit.Test;
 
 import static org.elasticsearch.common.settings.Settings.settingsBuilder;
-import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.equalTo;
 
 /**
@@ -49,4 +49,18 @@ public class YamlSettingsLoaderTests extends ElasticsearchTestCase {
         assertThat(settings.getAsArray("test1.test3")[0], equalTo("test3-1"));
         assertThat(settings.getAsArray("test1.test3")[1], equalTo("test3-2"));
     }
+
+    @Test(expected = SettingsException.class)
+    public void testIndentation() {
+        settingsBuilder()
+                .loadFromClasspath("org/elasticsearch/common/settings/loader/indentation-settings.yml")
+                .build();
+    }
+
+    @Test(expected = SettingsException.class)
+    public void testIndentationWithExplicitDocumentStart() {
+        settingsBuilder()
+                .loadFromClasspath("org/elasticsearch/common/settings/loader/indentation-with-explicit-document-start-settings.yml")
+                .build();
+    }
 }

core/src/test/java/org/elasticsearch/common/settings/loader/indentation-settings.yml

@@ -0,0 +1,10 @@
+ test1:
+   value1: value1
+   test2:
+     value2: value2
+     value3: 2
+   test3:
+     - test3-1
+     - test3-2
+test4:
+  value4: value4

core/src/test/java/org/elasticsearch/common/settings/loader/indentation-with-explicit-document-start-settings.yml

@@ -0,0 +1,11 @@
+ test1:
+   value1: value1
+   test2:
+     value2: value2
+     value3: 2
+   test3:
+     - test3-1
+     - test3-2
+---
+test4:
+  value4: value4