Skip to content

Commit

Permalink
Add ThreadContextPermission for stashAndMergeHeaders and stashWithOrigin
Browse files Browse the repository at this point in the history
Signed-off-by: Craig Perkins <[email protected]>
  • Loading branch information
cwperks committed Jul 31, 2024
1 parent 597747d commit 3892188
Show file tree
Hide file tree
Showing 3 changed files with 13 additions and 0 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,8 @@ public final class ThreadContext implements Writeable {
// thread context permissions

private static final Permission ACCESS_SYSTEM_THREAD_CONTEXT_PERMISSION = new ThreadContextPermission("markAsSystemContext");
private static final Permission STASH_AND_MERGE_THREAD_CONTEXT_PERMISSION = new ThreadContextPermission("stashAndMergeHeaders");
private static final Permission STASH_WITH_ORIGIN_THREAD_CONTEXT_PERMISSION = new ThreadContextPermission("stashWithOrigin");

private static final Logger logger = LogManager.getLogger(ThreadContext.class);
private static final ThreadContextStruct DEFAULT_CONTEXT = new ThreadContextStruct();
Expand Down Expand Up @@ -213,6 +215,10 @@ public Writeable captureAsWriteable() {
* if it can't find the task in memory.
*/
public StoredContext stashWithOrigin(String origin) {
SecurityManager sm = System.getSecurityManager();
if (sm != null) {
sm.checkPermission(STASH_WITH_ORIGIN_THREAD_CONTEXT_PERMISSION);
}
final ThreadContext.StoredContext storedContext = stashContext();
putTransient(ACTION_ORIGIN_TRANSIENT_NAME, origin);
return storedContext;
Expand All @@ -224,6 +230,10 @@ public StoredContext stashWithOrigin(String origin) {
* that are already existing are preserved unless they are defaults.
*/
public StoredContext stashAndMergeHeaders(Map<String, String> headers) {
SecurityManager sm = System.getSecurityManager();
if (sm != null) {
sm.checkPermission(STASH_AND_MERGE_THREAD_CONTEXT_PERMISSION);
}
final ThreadContextStruct context = threadLocal.get();
Map<String, String> newHeader = new HashMap<>(headers);
newHeader.putAll(context.requestHeaders);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ grant codeBase "${codebase.opensearch}" {
// needed for SPI class loading
permission java.lang.RuntimePermission "accessDeclaredMembers";
permission org.opensearch.secure_sm.ThreadContextPermission "markAsSystemContext";
permission org.opensearch.secure_sm.ThreadContextPermission "stashWithOrigin";
};

//// Very special jar permissions:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -158,4 +158,6 @@ grant {
permission java.lang.RuntimePermission "accessClassInPackage.sun.reflect";
permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
permission org.opensearch.secure_sm.ThreadContextPermission "markAsSystemContext";
permission org.opensearch.secure_sm.ThreadContextPermission "stashAndMergeHeaders";
permission org.opensearch.secure_sm.ThreadContextPermission "stashWithOrigin";
};

0 comments on commit 3892188

Please sign in to comment.