Skip to content

Commit e51afe1

Browse files
karenyrxkarenyrx
authored
Merge branch 'main' into just-terms
Signed-off-by: Karen X <[email protected]>
2 parents 8584024 + cd8fa4f commit e51afe1

File tree

19 files changed

+89
-53
lines changed

19 files changed

+89
-53
lines changed

‎CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
4343
- Unwrap singleton DocValues in date histogram aggregation. ([#17643](https://github.com/opensearch-project/OpenSearch/pull/17643))
4444
- Introduce 512 byte limit to search and ingest pipeline IDs ([#17786](https://github.com/opensearch-project/OpenSearch/pull/17786))
4545
- Avoid skewed segment replication lag metric ([#17831](https://github.com/opensearch-project/OpenSearch/pull/17831))
46+
- Increase the default segment counter step size when replica promoting ([#17568](https://github.com/opensearch-project/OpenSearch/pull/17568))
4647

4748
### Dependencies
4849
- Bump `com.nimbusds:nimbus-jose-jwt` from 9.41.1 to 10.0.2 ([#17607](https://github.com/opensearch-project/OpenSearch/pull/17607), [#17669](https://github.com/opensearch-project/OpenSearch/pull/17669))
@@ -63,6 +64,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
6364
- Bump `reactor_netty` from 1.1.26 to 1.2.3 ([#17322](https://github.com/opensearch-project/OpenSearch/pull/17322), [#17377](https://github.com/opensearch-project/OpenSearch/pull/17377))
6465
- Bump `com.google.api.grpc:proto-google-iam-v1` from 1.33.0 to 1.49.1 ([#17811](https://github.com/opensearch-project/OpenSearch/pull/17811))
6566
- Bump `com.azure:azure-core` from 1.54.1 to 1.55.3 ([#17810](https://github.com/opensearch-project/OpenSearch/pull/17810))
67+
- Bump `org.apache.poi` version from 5.2.5 to 5.4.1 in /plugins/ingest-attachment ([#17887](https://github.com/opensearch-project/OpenSearch/pull/17887))
6668
- Bump `org.opensearch:protobufs` from 0.2.0 to 0.3.0 ([#17888](https://github.com/opensearch-project/OpenSearch/pull/17888))
6769

6870
### Changed

‎gradle/ide.gradle‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,10 @@ if (System.getProperty('idea.active') == 'true') {
4949
}
5050
}
5151

52+
buildScan {
53+
server = 'https://127.0.0.1'
54+
}
55+
5256
idea {
5357
project {
5458
vcs = 'Git'
@@ -81,8 +85,14 @@ if (System.getProperty('idea.active') == 'true') {
8185
}
8286
runConfigurations {
8387
defaults(JUnit) {
84-
vmParameters = '-ea -Djava.locale.providers=SPI,CLDR'
85-
vmParameters += ' -javaagent:' + project(':libs:agent-sm:agent').jar.archiveFile.get()
88+
project(':libs:agent-sm:agent').afterEvaluate { agentProject ->
89+
vmParameters = '-ea -Djava.locale.providers=SPI,CLDR'
90+
def jarName = "${agentProject.base.archivesName.get()}-${project.version}.jar"
91+
vmParameters += ' -javaagent:' + agentProject.layout.buildDirectory
92+
.dir('distributions')
93+
.map { it.file(jarName) }
94+
.get()
95+
}
8696
}
8797
}
8898
copyright {

‎libs/agent-sm/agent/src/main/java/org/opensearch/javaagent/FileInterceptor.java‎

Lines changed: 53 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212

1313
import java.io.FilePermission;
1414
import java.lang.reflect.Method;
15+
import java.net.NetPermission;
1516
import java.nio.file.OpenOption;
1617
import java.nio.file.Path;
1718
import java.nio.file.Paths;
@@ -71,59 +72,70 @@ public static void intercept(@Advice.AllArguments Object[] args, @Advice.Origin
7172
boolean isMutating = name.equals("move") || name.equals("write") || name.startsWith("create");
7273
final boolean isDelete = isMutating == false ? name.startsWith("delete") : false;
7374

74-
String targetFilePath = null;
75-
if (isMutating == false && isDelete == false) {
76-
if (name.equals("newByteChannel") == true || name.equals("open") == true) {
77-
if (args.length > 1 && args[1] instanceof OpenOption[] opts) {
78-
for (final OpenOption opt : opts) {
79-
if (opt != StandardOpenOption.READ) {
80-
isMutating = true;
81-
break;
82-
}
83-
}
84-
85-
}
86-
} else if (name.equals("copy") == true) {
87-
if (args.length > 1 && args[1] instanceof String pathStr) {
88-
targetFilePath = Paths.get(pathStr).toAbsolutePath().toString();
89-
} else if (args.length > 1 && args[1] instanceof Path path) {
90-
targetFilePath = path.toAbsolutePath().toString();
75+
// This is Windows implementation of UNIX Domain Sockets (close)
76+
if (isDelete == true
77+
&& walker.getCallerClass().getName().equalsIgnoreCase("sun.nio.ch.PipeImpl$Initializer$LoopbackConnector") == true) {
78+
final NetPermission permission = new NetPermission("accessUnixDomainSocket");
79+
for (ProtectionDomain domain : callers) {
80+
if (!policy.implies(domain, permission)) {
81+
throw new SecurityException("Denied access to: " + filePath + ", domain " + domain);
9182
}
9283
}
93-
}
84+
} else {
85+
String targetFilePath = null;
86+
if (isMutating == false && isDelete == false) {
87+
if (name.equals("newByteChannel") == true || name.equals("open") == true) {
88+
if (args.length > 1 && args[1] instanceof OpenOption[] opts) {
89+
for (final OpenOption opt : opts) {
90+
if (opt != StandardOpenOption.READ) {
91+
isMutating = true;
92+
break;
93+
}
94+
}
9495

95-
// Check each permission separately
96-
for (final ProtectionDomain domain : callers) {
97-
// Handle FileChannel.open() separately to check read/write permissions properly
98-
if (method.getName().equals("open")) {
99-
if (isMutating == true && !policy.implies(domain, new FilePermission(filePath, "read,write"))) {
100-
throw new SecurityException("Denied OPEN (read/write) access to file: " + filePath + ", domain: " + domain);
101-
} else if (!policy.implies(domain, new FilePermission(filePath, "read"))) {
102-
throw new SecurityException("Denied OPEN (read) access to file: " + filePath + ", domain: " + domain);
96+
}
97+
} else if (name.equals("copy") == true) {
98+
if (args.length > 1 && args[1] instanceof String pathStr) {
99+
targetFilePath = Paths.get(pathStr).toAbsolutePath().toString();
100+
} else if (args.length > 1 && args[1] instanceof Path path) {
101+
targetFilePath = path.toAbsolutePath().toString();
102+
}
103103
}
104104
}
105105

106-
// Handle Files.copy() separately to check read/write permissions properly
107-
if (method.getName().equals("copy")) {
108-
if (!policy.implies(domain, new FilePermission(filePath, "read"))) {
109-
throw new SecurityException("Denied COPY (read) access to file: " + filePath + ", domain: " + domain);
106+
// Check each permission separately
107+
for (final ProtectionDomain domain : callers) {
108+
// Handle FileChannel.open() separately to check read/write permissions properly
109+
if (method.getName().equals("open")) {
110+
if (isMutating == true && !policy.implies(domain, new FilePermission(filePath, "read,write"))) {
111+
throw new SecurityException("Denied OPEN (read/write) access to file: " + filePath + ", domain: " + domain);
112+
} else if (!policy.implies(domain, new FilePermission(filePath, "read"))) {
113+
throw new SecurityException("Denied OPEN (read) access to file: " + filePath + ", domain: " + domain);
114+
}
110115
}
111116

112-
if (targetFilePath != null) {
113-
if (!policy.implies(domain, new FilePermission(targetFilePath, "write"))) {
114-
throw new SecurityException("Denied COPY (write) access to file: " + targetFilePath + ", domain: " + domain);
117+
// Handle Files.copy() separately to check read/write permissions properly
118+
if (method.getName().equals("copy")) {
119+
if (!policy.implies(domain, new FilePermission(filePath, "read"))) {
120+
throw new SecurityException("Denied COPY (read) access to file: " + filePath + ", domain: " + domain);
121+
}
122+
123+
if (targetFilePath != null) {
124+
if (!policy.implies(domain, new FilePermission(targetFilePath, "write"))) {
125+
throw new SecurityException("Denied COPY (write) access to file: " + targetFilePath + ", domain: " + domain);
126+
}
115127
}
116128
}
117-
}
118129

119-
// File mutating operations
120-
if (isMutating && !policy.implies(domain, new FilePermission(filePath, "write"))) {
121-
throw new SecurityException("Denied WRITE access to file: " + filePath + ", domain: " + domain);
122-
}
130+
// File mutating operations
131+
if (isMutating && !policy.implies(domain, new FilePermission(filePath, "write"))) {
132+
throw new SecurityException("Denied WRITE access to file: " + filePath + ", domain: " + domain);
133+
}
123134

124-
// File deletion operations
125-
if (isDelete && !policy.implies(domain, new FilePermission(filePath, "delete"))) {
126-
throw new SecurityException("Denied DELETE access to file: " + filePath + ", domain: " + domain);
135+
// File deletion operations
136+
if (isDelete && !policy.implies(domain, new FilePermission(filePath, "delete"))) {
137+
throw new SecurityException("Denied DELETE access to file: " + filePath + ", domain: " + domain);
138+
}
127139
}
128140
}
129141
}

‎modules/transport-netty4/src/main/plugin-metadata/plugin-security.policy‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ grant {
3636

3737
// netty makes and accepts socket connections
3838
permission java.net.SocketPermission "*", "accept,connect";
39+
permission java.net.NetPermission "accessUnixDomainSocket";
3940

4041
// Netty sets custom classloader for some of its internal threads
4142
permission java.lang.RuntimePermission "*", "setContextClassLoader";

‎plugins/ingest-attachment/build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ opensearchplugin {
4040
versions << [
4141
'tika' : '2.9.2',
4242
'pdfbox': '2.0.31',
43-
'poi' : '5.2.5',
43+
'poi' : '5.4.1',
4444
'mime4j': '0.8.11'
4545
]
4646

‎plugins/ingest-attachment/licenses/poi-5.2.5.jar.sha1‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎plugins/ingest-attachment/licenses/poi-5.4.1.jar.sha1‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
e4c74c59e13f62d8edd215756d14ce55566c6efe

‎plugins/ingest-attachment/licenses/poi-ooxml-5.2.5.jar.sha1‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎plugins/ingest-attachment/licenses/poi-ooxml-5.4.1.jar.sha1‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
508ed3e7fcc775738415870d0bc6d27196317fe3

‎plugins/ingest-attachment/licenses/poi-ooxml-lite-5.2.5.jar.sha1‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

0 commit comments

Comments
 (0)