honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

XContent: Check for bad parsers (#34561) 

Adds checks for misbehaving parsers. The checks aren't perfect at all but
they are simple and fast enough that we can do them all the time so
they'll catch most badly behaving parsers.

Closes #34351
This commit is contained in:
Nik Everett 2018-10-25 17:03:42 -04:00 committed by GitHub
parent e27a0d5b0d
commit 3cde1356c1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 70 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
client/rest-high-level/src/main/java/org/elasticsearch/client/security/PutRoleMappingResponse.java
View File

@ -64,11 +64,10 @@ public final class PutRoleMappingResponse {
private static final ConstructingObjectParser<PutRoleMappingResponse, Void> PARSER = new ConstructingObjectParser<>(
"put_role_mapping_response", true, args -> new PutRoleMappingResponse((boolean) args[0]));
static {
PARSER.declareBoolean(constructorArg(), new ParseField("created"));
// To parse the "created" field we declare "role_mapping" field object.
// Once the nested field "created" is found parser constructs the target object and
// ignores the role_mapping object.
PARSER.declareObject((a,b) -> {}, (parser, context) -> null, new ParseField("role_mapping"));
ConstructingObjectParser<Boolean, Void> roleMappingParser = new ConstructingObjectParser<>(
"put_role_mapping_response.role_mapping", true, args -> (Boolean) args[0]);
roleMappingParser.declareBoolean(constructorArg(), new ParseField("created"));
PARSER.declareObject(constructorArg(), roleMappingParser::parse, new ParseField("role_mapping"));
}
public static PutRoleMappingResponse fromXContent(XContentParser parser) throws IOException {

22
libs/x-content/src/main/java/org/elasticsearch/common/xcontent/ObjectParser.java
View File

@ -324,9 +324,31 @@ public final class ObjectParser<Value, Context> extends AbstractObjectParser<Val
switch (token) {
case START_OBJECT:
parseValue(parser, fieldParser, currentFieldName, value, context);
/*
* Well behaving parsers should consume the entire object but
* asserting that they do that is not something we can do
* efficiently here. Instead we can check that they end on an
* END_OBJECT. They could end on the *wrong* end object and
* this test won't catch them, but that is the price that we pay
* for having a cheap test.
*/
if (parser.currentToken() != XContentParser.Token.END_OBJECT) {
throw new IllegalStateException("parser for [" + currentFieldName + "] did not end on END_OBJECT");
}
break;
case START_ARRAY:
parseArray(parser, fieldParser, currentFieldName, value, context);
/*
* Well behaving parsers should consume the entire array but
* asserting that they do that is not something we can do
* efficiently here. Instead we can check that they end on an
* END_ARRAY. They could end on the *wrong* end array and
* this test won't catch them, but that is the price that we pay
* for having a cheap test.
*/
if (parser.currentToken() != XContentParser.Token.END_ARRAY) {
throw new IllegalStateException("parser for [" + currentFieldName + "] did not end on END_ARRAY");
}
break;
case END_OBJECT:
case END_ARRAY:

44
libs/x-content/src/test/java/org/elasticsearch/common/xcontent/ObjectParserTests.java
View File

@ -34,6 +34,7 @@ import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.List;
import java.util.concurrent.atomic.AtomicReference;
import static org.hamcrest.Matchers.containsString;
import static org.hamcrest.Matchers.hasSize;
@ -650,6 +651,49 @@ public class ObjectParserTests extends ESTestCase {
assertThat(ex.getMessage(), containsString("[foo] failed to parse field [int_array]"));
}
public void testNoopDeclareObject() throws IOException {
ObjectParser<AtomicReference<String>, Void> parser = new ObjectParser<>("noopy", AtomicReference::new);
parser.declareString(AtomicReference::set, new ParseField("body"));
parser.declareObject((a,b) -> {}, (p, c) -> null, new ParseField("noop"));
assertEquals("i", parser.parse(createParser(JsonXContent.jsonXContent, "{\"body\": \"i\"}"), null).get());
Exception garbageException = expectThrows(IllegalStateException.class, () -> parser.parse(
createParser(JsonXContent.jsonXContent, "{\"noop\": {\"garbage\": \"shouldn't\"}}"),
null));
assertEquals("parser for [noop] did not end on END_OBJECT", garbageException.getMessage());
Exception sneakyException = expectThrows(IllegalStateException.class, () -> parser.parse(
createParser(JsonXContent.jsonXContent, "{\"noop\": {\"body\": \"shouldn't\"}}"),
null));
assertEquals("parser for [noop] did not end on END_OBJECT", sneakyException.getMessage());
}
public void testNoopDeclareField() throws IOException {
ObjectParser<AtomicReference<String>, Void> parser = new ObjectParser<>("noopy", AtomicReference::new);
parser.declareString(AtomicReference::set, new ParseField("body"));
parser.declareField((a,b) -> {}, (p, c) -> null, new ParseField("noop"), ValueType.STRING_ARRAY);
assertEquals("i", parser.parse(createParser(JsonXContent.jsonXContent, "{\"body\": \"i\"}"), null).get());
Exception e = expectThrows(IllegalStateException.class, () -> parser.parse(
createParser(JsonXContent.jsonXContent, "{\"noop\": [\"ignored\"]}"),
null));
assertEquals("parser for [noop] did not end on END_ARRAY", e.getMessage());
}
public void testNoopDeclareObjectArray() throws IOException {
ObjectParser<AtomicReference<String>, Void> parser = new ObjectParser<>("noopy", AtomicReference::new);
parser.declareString(AtomicReference::set, new ParseField("body"));
parser.declareObjectArray((a,b) -> {}, (p, c) -> null, new ParseField("noop"));
XContentParseException garbageError = expectThrows(XContentParseException.class, () -> parser.parse(
createParser(JsonXContent.jsonXContent, "{\"noop\": [{\"garbage\": \"shouldn't\"}}]"),
null));
assertEquals("expected value but got [FIELD_NAME]", garbageError.getCause().getMessage());
XContentParseException sneakyError = expectThrows(XContentParseException.class, () -> parser.parse(
createParser(JsonXContent.jsonXContent, "{\"noop\": [{\"body\": \"shouldn't\"}}]"),
null));
assertEquals("expected value but got [FIELD_NAME]", sneakyError.getCause().getMessage());
}
static class NamedObjectHolder {
public static final ObjectParser<NamedObjectHolder, Void> PARSER = new ObjectParser<>("named_object_holder",
NamedObjectHolder::new);