Allow fine-grained script settings

[gibrown]

Would be good to globally disallow scripting based on the type of operation being done.

In particular I want to prevent scripting on queries but allow scripting in update/index operations.

Or maybe just separate this by which thread pool it is running in?

Related to #5943

[clintongormley]

Hi @gibrown

What's your use case for this?

[gibrown]

We don't allow (or want) any scripting on queries. We have a lot of internal and external users creating queries, and I don't trust running scripts in any of the queries. We try and prevent that in our client code, but given how easily you could bring down a cluster with a script I'd prefer them to be completely disabled for queries.

But for update operations scripting is extremely necessary. The update API is mostly useless with scripting turned off, and using the update API is necessary to scale our indexing.

So I think it would beneficial to individually configure which endpoints can accept scripts.

[clintongormley]

@gibrown thanks for the info. These script settings also relate to the script source ie #7147, and sandboxed vs enabled vs disabled.

For instance, you may want to allow sandboxed dynamic scripting for updates, but only predefined indexed scripts for search (but without sandboxing). Wondering if we need to support general settings (for ease of use) and more specific settings (for flexible control). There are also differences between scripting engines that make some safer than others, regardless of sandboxing. For instance, even though groovy is sandboxed, a simple while (true) {} will run forever. Expressions, on the other hand, doesn't have loops and so doesn't suffer from that issue.

The settings need to cover the following combinations

• mode: enabled, disabled, sandboxed
• source: indexed, dynamic, file
• engine: groovy, expressions, mustache, etc
• operation: update, search, aggs

I propose the following specific settings, which is what the code will use to decide whether to allow a script or not:

script.engine.groovy.indexed.update:    sandbox/enable/disable
script.engine.groovy.indexed.search:    sandbox/enable/disable
script.engine.groovy.indexed.aggs:      sandbox/enable/disable
script.engine.groovy.dynamic.update:    sandbox/enable/disable
script.engine.groovy.dynamic.search:    sandbox/enable/disable
script.engine.groovy.dynamic.aggs:      sandbox/enable/disable
script.engine.groovy.file.update:       sandbox/enable/disable
script.engine.groovy.file.search:       sandbox/enable/disable
script.engine.groovy.file.aggs:         sandbox/enable/disable

For ease of use, we should also support the following more generic settings:

script.all:     sandbox/enable/disable  (default: `sandbox`)

script.indexed: sandbox/enable/disable
script.dynamic: sandbox/enable/disable
script.file:    sandbox/enable/disable

script.update:  sandbox/enable/disable
script.search:  sandbox/enable/disable
script.aggs:    sandbox/enable/disable

These will be used to calculate the more specific settings, using the stricter setting of each combination, eg:

script.all:                             sandbox
script.dynamic:                         disable
script.search:                          disable
script.engine.groovy.file.search:       enable

will result in the following specific settings:

script.engine.groovy.indexed.update:    sandbox
script.engine.groovy.indexed.search:    disable
script.engine.groovy.indexed.aggs:      sandbox
script.engine.groovy.dynamic.update:    disable
script.engine.groovy.dynamic.search:    disable
script.engine.groovy.dynamic.aggs:      disable
script.engine.groovy.file.update:       sandbox
script.engine.groovy.file.search:       enable
script.engine.groovy.file.aggs:         sandbox

[gibrown]

Those sound great to me. Would definitely work for my case.