Make sure that field-level security is enforced when using field alia…

…ses. (#31807) * Add basic unit tests for field level security with field aliases. * Ensure that field caps information is filtered when a field alias is provided.
elastic · Jul 17, 2018 · 270a924 · 270a924
1 parent beda48e
commit 270a924
Show file tree

Hide file tree

Showing 3 changed files with 235 additions and 35 deletions.
diff --git a/...c/main/java/org/elasticsearch/action/fieldcaps/TransportFieldCapabilitiesIndexAction.java b/...c/main/java/org/elasticsearch/action/fieldcaps/TransportFieldCapabilitiesIndexAction.java
@@ -83,8 +83,8 @@ protected FieldCapabilitiesIndexResponse shardOperation(final FieldCapabilitiesI
         for (String field : fieldNames) {
             MappedFieldType ft = mapperService.fullName(field);
             if (ft != null) {
-                FieldCapabilities fieldCap = new FieldCapabilities(field, ft.typeName(), ft.isSearchable(), ft.isAggregatable());
-                if (indicesService.isMetaDataField(field) || fieldPredicate.test(field)) {
+                if (indicesService.isMetaDataField(field) || fieldPredicate.test(ft.name())) {
+                    FieldCapabilities fieldCap = new FieldCapabilities(field, ft.typeName(), ft.isSearchable(), ft.isAggregatable());
                     responseMap.put(field, fieldCap);
                 }
             }

diff --git a/server/src/test/java/org/elasticsearch/search/fieldcaps/FieldCapabilitiesIT.java b/server/src/test/java/org/elasticsearch/search/fieldcaps/FieldCapabilitiesIT.java
@@ -23,10 +23,16 @@
 import org.elasticsearch.action.fieldcaps.FieldCapabilitiesResponse;
 import org.elasticsearch.common.xcontent.XContentBuilder;
 import org.elasticsearch.common.xcontent.XContentFactory;
+import org.elasticsearch.plugins.MapperPlugin;
+import org.elasticsearch.plugins.Plugin;
 import org.elasticsearch.test.ESIntegTestCase;
 import org.junit.Before;
 
+import java.util.Collection;
+import java.util.Collections;
 import java.util.Map;
+import java.util.function.Function;
+import java.util.function.Predicate;
 
 import static org.elasticsearch.test.hamcrest.ElasticsearchAssertions.assertAcked;
 
@@ -47,6 +53,13 @@ public void setUp() throws Exception {
                             .field("type", "alias")
                             .field("path", "distance")
                         .endObject()
+                        .startObject("playlist")
+                            .field("type", "text")
+                        .endObject()
+                        .startObject("secret_soundtrack")
+                            .field("type", "alias")
+                            .field("path", "playlist")
+                        .endObject()
                     .endObject()
                 .endObject()
             .endObject();
@@ -68,6 +81,18 @@ public void setUp() throws Exception {
         assertAcked(prepareCreate("new_index").addMapping("_doc", newIndexMapping));
     }
 
+    public static class FieldFilterPlugin extends Plugin implements MapperPlugin {
+        @Override
+        public Function<String, Predicate<String>> getFieldFilter() {
+            return index -> field -> !field.equals("playlist");
+        }
+    }
+
+    @Override
+    protected Collection<Class<? extends Plugin>> nodePlugins() {
+        return Collections.singleton(FieldFilterPlugin.class);
+    }
+
     public void testFieldAlias() {
         FieldCapabilitiesResponse response = client().prepareFieldCaps().setFields("distance", "route_length_miles")
             .execute().actionGet();
@@ -100,11 +125,27 @@ public void testFieldAlias() {
             routeLength.get("double"));
     }
 
-    public void testFieldAliasWithWildcardField() {
+    public void testFieldAliasWithWildcard() {
         FieldCapabilitiesResponse response = client().prepareFieldCaps().setFields("route*")
             .execute().actionGet();
 
         assertEquals(1, response.get().size());
         assertTrue(response.get().containsKey("route_length_miles"));
     }
+
+    public void testFieldAliasFiltering() {
+        FieldCapabilitiesResponse response = client().prepareFieldCaps().setFields(
+            "secret-soundtrack", "route_length_miles")
+            .execute().actionGet();
+        assertEquals(1, response.get().size());
+        assertTrue(response.get().containsKey("route_length_miles"));
+    }
+
+    public void testFieldAliasFilteringWithWildcard() {
+        FieldCapabilitiesResponse response = client().prepareFieldCaps()
+            .setFields("distance", "secret*")
+            .execute().actionGet();
+        assertEquals(1, response.get().size());
+        assertTrue(response.get().containsKey("distance"));
+    }
 }