public void testEvilGroovyScripts() throws Exception {
        int nodes = randomIntBetween(1, 3);
        Settings nodeSettings = Settings.builder()
                .put("script.inline", true)
                .put("script.indexed", true)
                .build();
        internalCluster().startNodesAsync(nodes, nodeSettings).get();
        client().admin().cluster().prepareHealth().setWaitForNodes(nodes + "").get();
        client().prepareIndex("test", "doc", "1").setSource("foo", 5, "bar", "baz").setRefresh(true).get();
        // Plain test
        assertSuccess("");
        // numeric field access
        assertSuccess("def foo = doc['foo'].value; if (foo == null) { return 5; }");
        // string field access
        assertSuccess("def bar = doc['bar'].value; if (bar == null) { return 5; }");
        // List
        assertSuccess("def list = [doc['foo'].value, 3, 4]; def v = list.get(1); list.add(10)");
        // Ranges
        assertSuccess("def range = 1..doc['foo'].value; def v = range.get(0)");
        // Maps
        assertSuccess("def v = doc['foo'].value; def m = [:]; m.put(\"value\", v)");
        // Times
        assertSuccess("def t = Instant.now().getMillis()");
        // GroovyCollections
        assertSuccess("def n = [1,2,3]; GroovyCollections.max(n)");
        // Fail cases:
        // AccessControlException[access denied ("java.io.FilePermission" "<<ALL FILES>>" "execute")]
        assertFailure("pr = Runtime.getRuntime().exec(\"touch /tmp/gotcha\"); pr.waitFor()");
        // AccessControlException[access denied ("java.lang.RuntimePermission" "accessClassInPackage.sun.reflect")]
        assertFailure("d = new DateTime(); d.getClass().getDeclaredMethod(\"year\").setAccessible(true)");
        assertFailure("d = new DateTime(); d.\"${'get' + 'Class'}\"()." +
                        "\"${'getDeclared' + 'Method'}\"(\"year\").\"${'set' + 'Accessible'}\"(false)");
        assertFailure("Class.forName(\"org.joda.time.DateTime\").getDeclaredMethod(\"year\").setAccessible(true)");
        // AccessControlException[access denied ("groovy.security.GroovyCodeSourcePermission" "/groovy/shell")]
        assertFailure("Eval.me('2 + 2')");
        assertFailure("Eval.x(5, 'x + 2')");
        // AccessControlException[access denied ("java.lang.RuntimePermission" "accessDeclaredMembers")]
        assertFailure("d = new Date(); java.lang.reflect.Field f = Date.class.getDeclaredField(\"fastTime\");" +
                " f.setAccessible(true); f.get(\"fastTime\")");
        // AccessControlException[access denied ("java.io.FilePermission" "<<ALL FILES>>" "execute")]
        assertFailure("def methodName = 'ex'; Runtime.\"${'get' + 'Runtime'}\"().\"${methodName}ec\"(\"touch /tmp/gotcha2\")");
        // AccessControlException[access denied ("java.lang.RuntimePermission" "modifyThreadGroup")]
        assertFailure("t = new Thread({ println 3 });");
        // test a directory we normally have access to, but the groovy script does not.
        Path dir = createTempDir();
        // TODO: figure out the necessary escaping for windows paths here :)
        if (!Constants.WINDOWS) {
            // access denied ("java.io.FilePermission" ".../tempDir-00N" "read")
            assertFailure("new File(\"" + dir + "\").exists()");
        }
    }
public void testEvilGroovyScripts() throws Exception {
        int nodes = randomIntBetween(1, 3);
        Settings nodeSettings = Settings.builder()
                .put("script.inline", true)
                .put("script.indexed", true)
                .build();
        internalCluster().startNodesAsync(nodes, nodeSettings).get();
        client().admin().cluster().prepareHealth().setWaitForNodes(nodes + "").get();
        client().prepareIndex("test", "doc", "1").setSource("foo", 5, "bar", "baz").setRefresh(true).get();
       
        assertSuccess("");
       
        assertSuccess("def foo = doc['foo'].value; if (foo == null) { return 5; }");
       
        assertSuccess("def bar = doc['bar'].value; if (bar == null) { return 5; }");
       
        assertSuccess("def list = [doc['foo'].value, 3, 4]; def v = list.get(1); list.add(10)");
       
        assertSuccess("def range = 1..doc['foo'].value; def v = range.get(0)");
       
        assertSuccess("def v = doc['foo'].value; def m = [:]; m.put(\"value\", v)");
       
        assertSuccess("def t = Instant.now().getMillis()");
       
        assertSuccess("def n = [1,2,3]; GroovyCollections.max(n)");
       
       
        assertFailure("pr = Runtime.getRuntime().exec(\"touch /tmp/gotcha\"); pr.waitFor()");
       
        assertFailure("d = new DateTime(); d.getClass().getDeclaredMethod(\"year\").setAccessible(true)");
        assertFailure("d = new DateTime(); d.\"${'get' + 'Class'}\"()." +
                        "\"${'getDeclared' + 'Method'}\"(\"year\").\"${'set' + 'Accessible'}\"(false)");
        assertFailure("Class.forName(\"org.joda.time.DateTime\").getDeclaredMethod(\"year\").setAccessible(true)");
       
        assertFailure("Eval.me('2 + 2')");
        assertFailure("Eval.x(5, 'x + 2')");
       
        assertFailure("d = new Date(); java.lang.reflect.Field f = Date.class.getDeclaredField(\"fastTime\");" +
                " f.setAccessible(true); f.get(\"fastTime\")");
       
        assertFailure("def methodName = 'ex'; Runtime.\"${'get' + 'Runtime'}\"().\"${methodName}ec\"(\"touch /tmp/gotcha2\")");
       
        assertFailure("t = new Thread({ println 3 });");
       
        Path dir = createTempDir();
       
        if (!Constants.WINDOWS) {
           
            assertFailure("new File(\"" + dir + "\").exists()");
        }
    }
public void testevilgroovyscripts() throws exception { int nodes = randomintbetween(1, 3); settings nodesettings = settings.builder() .put("script.inline", true) .put("script.indexed", true) .build(); internalcluster().startnodesasync(nodes, nodesettings).get(); client().admin().cluster().preparehealth().setwaitfornodes(nodes + "").get(); client().prepareindex("test", "doc", "1").setsource("foo", 5, "bar", "baz").setrefresh(true).get(); assertsuccess(""); assertsuccess("def foo = doc['foo'].value; if (foo == null) { return 5; }"); assertsuccess("def bar = doc['bar'].value; if (bar == null) { return 5; }"); assertsuccess("def list = [doc['foo'].value, 3, 4]; def v = list.get(1); list.add(10)"); assertsuccess("def range = 1..doc['foo'].value; def v = range.get(0)"); assertsuccess("def v = doc['foo'].value; def m = [:]; m.put(\"value\", v)"); assertsuccess("def t = instant.now().getmillis()"); assertsuccess("def n = [1,2,3]; groovycollections.max(n)"); assertfailure("pr = runtime.getruntime().exec(\"touch /tmp/gotcha\"); pr.waitfor()"); assertfailure("d = new datetime(); d.getclass().getdeclaredmethod(\"year\").setaccessible(true)"); assertfailure("d = new datetime(); d.\"${'get' + 'class'}\"()." + "\"${'getdeclared' + 'method'}\"(\"year\").\"${'set' + 'accessible'}\"(false)"); assertfailure("class.forname(\"org.joda.time.datetime\").getdeclaredmethod(\"year\").setaccessible(true)"); assertfailure("eval.me('2 + 2')"); assertfailure("eval.x(5, 'x + 2')"); assertfailure("d = new date(); java.lang.reflect.field f = date.class.getdeclaredfield(\"fasttime\");" + " f.setaccessible(true); f.get(\"fasttime\")"); assertfailure("def methodname = 'ex'; runtime.\"${'get' + 'runtime'}\"().\"${methodname}ec\"(\"touch /tmp/gotcha2\")"); assertfailure("t = new thread({ println 3 });"); path dir = createtempdir(); if (!constants.windows) { assertfailure("new file(\"" + dir + "\").exists()"); } }