Skip to content

Commit 27d80f2

Browse files
ldematteldematte
authored
[Entitlements] Add URLConnection instrumentation for file protocol (#123824) (#124064)
1 parent 33a9cc8 commit 27d80f2

File tree

5 files changed

+266
-0
lines changed

5 files changed

+266
-0
lines changed

‎libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java

+20
Original file line numberDiff line numberDiff line change
@@ -1148,6 +1148,26 @@ void checkPathRegister(
11481148
WatchEvent.Modifier... modifiers
11491149
);
11501150

1151+
// URLConnection
1152+
1153+
void check$sun_net_www_protocol_file_FileURLConnection$connect(Class<?> callerClass, java.net.URLConnection that);
1154+
1155+
void check$sun_net_www_protocol_file_FileURLConnection$getHeaderFields(Class<?> callerClass, java.net.URLConnection that);
1156+
1157+
void check$sun_net_www_protocol_file_FileURLConnection$getHeaderField(Class<?> callerClass, java.net.URLConnection that, String name);
1158+
1159+
void check$sun_net_www_protocol_file_FileURLConnection$getHeaderField(Class<?> callerClass, java.net.URLConnection that, int n);
1160+
1161+
void check$sun_net_www_protocol_file_FileURLConnection$getContentLength(Class<?> callerClass, java.net.URLConnection that);
1162+
1163+
void check$sun_net_www_protocol_file_FileURLConnection$getContentLengthLong(Class<?> callerClass, java.net.URLConnection that);
1164+
1165+
void check$sun_net_www_protocol_file_FileURLConnection$getHeaderFieldKey(Class<?> callerClass, java.net.URLConnection that, int n);
1166+
1167+
void check$sun_net_www_protocol_file_FileURLConnection$getLastModified(Class<?> callerClass, java.net.URLConnection that);
1168+
1169+
void check$sun_net_www_protocol_file_FileURLConnection$getInputStream(Class<?> callerClass, java.net.URLConnection that);
1170+
11511171
////////////////////
11521172
//
11531173
// Thread management

‎libs/entitlement/qa/entitled-plugin/src/main/java/org/elasticsearch/entitlement/qa/entitled/EntitledActions.java

+5
Original file line numberDiff line numberDiff line change
@@ -71,4 +71,9 @@ public static URLConnection createHttpsURLConnection() throws IOException {
7171
public static URLConnection createFtpURLConnection() throws IOException {
7272
return URI.create("ftp://127.0.0.1:12345/").toURL().openConnection();
7373
}
74+
75+
public static URLConnection createFileURLConnection() throws IOException {
76+
var fileUrl = createTempFileForWrite().toUri().toURL();
77+
return fileUrl.openConnection();
78+
}
7479
}

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/RestEntitlementsCheckAction.java

+1
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,7 @@ static CheckAction alwaysDenied(CheckedRunnable<Exception> action) {
194194
getTestEntries(PathActions.class),
195195
getTestEntries(SpiActions.class),
196196
getTestEntries(SystemActions.class),
197+
getTestEntries(URLConnectionFileActions.class),
197198
getTestEntries(URLConnectionNetworkActions.class),
198199
getTestEntries(VersionSpecificManageThreadsActions.class),
199200
getTestEntries(VersionSpecificNioFileSystemActions.class)

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/URLConnectionFileActions.java

+117
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the "Elastic License
4+
* 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
5+
* Public License v 1"; you may not use this file except in compliance with, at
6+
* your election, the "Elastic License 2.0", the "GNU Affero General Public
7+
* License v3.0 only", or the "Server Side Public License, v 1".
8+
*/
9+
10+
package org.elasticsearch.entitlement.qa.test;
11+
12+
import org.elasticsearch.core.CheckedConsumer;
13+
import org.elasticsearch.entitlement.qa.entitled.EntitledActions;
14+
15+
import java.io.IOException;
16+
import java.net.URLConnection;
17+
18+
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.PLUGINS;
19+
20+
class URLConnectionFileActions {
21+
22+
private static void withJdkFileConnection(CheckedConsumer<URLConnection, Exception> connectionConsumer) throws Exception {
23+
var conn = EntitledActions.createFileURLConnection();
24+
// Be sure we got the connection implementation we want
25+
assert conn.getClass().getSimpleName().equals("FileURLConnection");
26+
try {
27+
connectionConsumer.accept(conn);
28+
} catch (IOException e) {
29+
// It's OK, it means we passed entitlement checks, and we tried to perform some operation
30+
}
31+
}
32+
33+
@EntitlementTest(expectedAccess = PLUGINS)
34+
static void sunFileURLConnectionConnect() throws Exception {
35+
withJdkFileConnection(URLConnection::connect);
36+
}
37+
38+
@EntitlementTest(expectedAccess = PLUGINS)
39+
static void sunFileURLConnectionGetHeaderFields() throws Exception {
40+
withJdkFileConnection(URLConnection::getHeaderFields);
41+
}
42+
43+
@EntitlementTest(expectedAccess = PLUGINS)
44+
static void sunFileURLConnectionGetHeaderFieldWithName() throws Exception {
45+
withJdkFileConnection(urlConnection -> urlConnection.getHeaderField("date"));
46+
}
47+
48+
@EntitlementTest(expectedAccess = PLUGINS)
49+
static void sunFileURLConnectionGetHeaderFieldWithIndex() throws Exception {
50+
withJdkFileConnection(urlConnection -> urlConnection.getHeaderField(0));
51+
}
52+
53+
@EntitlementTest(expectedAccess = PLUGINS)
54+
static void sunFileURLConnectionGetContentLength() throws Exception {
55+
withJdkFileConnection(URLConnection::getContentLength);
56+
}
57+
58+
@EntitlementTest(expectedAccess = PLUGINS)
59+
static void sunFileURLConnectionGetContentLengthLong() throws Exception {
60+
withJdkFileConnection(URLConnection::getContentLengthLong);
61+
}
62+
63+
@EntitlementTest(expectedAccess = PLUGINS)
64+
static void sunFileURLConnectionGetHeaderFieldKey() throws Exception {
65+
withJdkFileConnection(urlConnection -> urlConnection.getHeaderFieldKey(0));
66+
}
67+
68+
@EntitlementTest(expectedAccess = PLUGINS)
69+
static void sunFileURLConnectionGetLastModified() throws Exception {
70+
withJdkFileConnection(URLConnection::getLastModified);
71+
}
72+
73+
@EntitlementTest(expectedAccess = PLUGINS)
74+
static void sunFileURLConnectionGetInputStream() throws Exception {
75+
withJdkFileConnection(URLConnection::getInputStream);
76+
}
77+
78+
@EntitlementTest(expectedAccess = PLUGINS)
79+
static void sunFileURLConnectionGetContentType() throws Exception {
80+
withJdkFileConnection(URLConnection::getContentType);
81+
}
82+
83+
@EntitlementTest(expectedAccess = PLUGINS)
84+
static void sunFileURLConnectionGetContentEncoding() throws Exception {
85+
withJdkFileConnection(URLConnection::getContentEncoding);
86+
}
87+
88+
@EntitlementTest(expectedAccess = PLUGINS)
89+
static void sunFileURLConnectionGetExpiration() throws Exception {
90+
withJdkFileConnection(URLConnection::getExpiration);
91+
}
92+
93+
@EntitlementTest(expectedAccess = PLUGINS)
94+
static void sunFileURLConnectionGetDate() throws Exception {
95+
withJdkFileConnection(URLConnection::getDate);
96+
}
97+
98+
@EntitlementTest(expectedAccess = PLUGINS)
99+
static void sunFileURLConnectionGetHeaderFieldInt() throws Exception {
100+
withJdkFileConnection(conn -> conn.getHeaderFieldInt("field", 0));
101+
}
102+
103+
@EntitlementTest(expectedAccess = PLUGINS)
104+
static void sunFileURLConnectionGetHeaderFieldLong() throws Exception {
105+
withJdkFileConnection(conn -> conn.getHeaderFieldLong("field", 0));
106+
}
107+
108+
@EntitlementTest(expectedAccess = PLUGINS)
109+
static void sunFileURLConnectionGetContent() throws Exception {
110+
withJdkFileConnection(URLConnection::getContent);
111+
}
112+
113+
@EntitlementTest(expectedAccess = PLUGINS)
114+
static void sunFileURLConnectionGetContentWithClasses() throws Exception {
115+
withJdkFileConnection(conn -> conn.getContent(new Class<?>[] { String.class }));
116+
}
117+
}

0 commit comments

Comments
 (0)