From 6b11b760ae69f76ce450d5dbad8f6a85d6abc309 Mon Sep 17 00:00:00 2001
From: Shay Banon <kimchy@gmail.com>
Date: Tue, 6 Mar 2012 22:03:02 +0200
Subject: [PATCH] Scripting: Allow to disable dynamic script execution, closes
 #1763.

---
 .../org/elasticsearch/script/ScriptService.java    | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/main/java/org/elasticsearch/script/ScriptService.java b/src/main/java/org/elasticsearch/script/ScriptService.java
index 5542be73f3a..d6f2fd3b3fd 100644
--- a/src/main/java/org/elasticsearch/script/ScriptService.java
+++ b/src/main/java/org/elasticsearch/script/ScriptService.java
@@ -58,6 +58,8 @@ public class ScriptService extends AbstractComponent {
     // TODO expose some cache aspects like expiration and max size
     private final Cache<CacheKey, CompiledScript> cache = CacheBuilder.newBuilder().build();
 
+    private final boolean disableDynamic;
+
     public ScriptService(Settings settings) {
         this(settings, new Environment(), ImmutableSet.<ScriptEngineService>builder()
                 .add(new MvelScriptEngineService(settings))
@@ -70,6 +72,7 @@ public class ScriptService extends AbstractComponent {
         super(settings);
 
         this.defaultLang = componentSettings.get("default_lang", "mvel");
+        this.disableDynamic = componentSettings.getAsBoolean("disable_dynamic", false);
 
         ImmutableMap.Builder<String, ScriptEngineService> builder = ImmutableMap.builder();
         for (ScriptEngineService scriptEngine : scriptEngines) {
@@ -142,6 +145,9 @@ public class ScriptService extends AbstractComponent {
         if (lang == null) {
             lang = defaultLang;
         }
+        if (dynamicScriptDisabled(lang)) {
+            throw new ScriptException("dynamic scripting disabled");
+        }
         CacheKey cacheKey = new CacheKey(lang, script);
         compiled = cache.getIfPresent(cacheKey);
         if (compiled != null) {
@@ -185,6 +191,14 @@ public class ScriptService extends AbstractComponent {
         cache.invalidateAll();
     }
 
+    private boolean dynamicScriptDisabled(String lang) {
+        if (!disableDynamic) {
+            return false;
+        }
+        // we allow "native" executions since they register through plugins, so they are "allowed"
+        return !"native".equals(lang);
+    }
+
     public static class CacheKey {
         public final String lang;
         public final String script;