honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #14500 from rmuir/groovy_json 

Add property permissions so groovy scripts can serialize json
This commit is contained in:
Robert Muir 2015-11-03 16:29:25 -05:00
parent 6bf640293c 79467a138a
commit bcf05cf2b8
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
core/src/main/resources/org/elasticsearch/bootstrap/untrusted.policy
View File

@ -26,6 +26,10 @@ grant {
// groovy IndyInterface bootstrap requires this property for indy logging // groovy IndyInterface bootstrap requires this property for indy logging
permission java.util.PropertyPermission "groovy.indy.logging", "read"; permission java.util.PropertyPermission "groovy.indy.logging", "read";
// groovy JsonOutput, just allow it to read these props so it works (unsafe is not allowed)
permission java.util.PropertyPermission "groovy.json.faststringutils.disable", "read";
permission java.util.PropertyPermission "groovy.json.faststringutils.write.to.final.fields", "read";
// needed by Rhino engine exception handling // needed by Rhino engine exception handling
permission java.util.PropertyPermission "rhino.stack.style", "read"; permission java.util.PropertyPermission "rhino.stack.style", "read";

2
plugins/lang-groovy/src/test/java/org/elasticsearch/script/groovy/GroovySecurityTests.java
View File

@ -64,6 +64,8 @@ public class GroovySecurityTests extends ESTestCase {
assertSuccess("def range = 1..doc['foo'].value; def v = range.get(0)"); assertSuccess("def range = 1..doc['foo'].value; def v = range.get(0)");
// Maps // Maps
assertSuccess("def v = doc['foo'].value; def m = [:]; m.put(\"value\", v)"); assertSuccess("def v = doc['foo'].value; def m = [:]; m.put(\"value\", v)");
// serialization to json (this is best effort considering the unsafe etc at play)
assertSuccess("def x = 5; groovy.json.JsonOutput.toJson(x)");
// Times // Times
assertSuccess("def t = Instant.now().getMillis()"); assertSuccess("def t = Instant.now().getMillis()");
// GroovyCollections // GroovyCollections