[Backport 2.19] Strengthen scroll_id validation

[opensearch-ci-bot]

Backport bcf120a from #22396.

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🧪 PR contains tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ No major issues detected

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
General	Tighten upper bound for entry count The upper bound count > bytes.length is still too permissive because each SearchContextIdForNode entry requires multiple bytes to encode (contextUUID string, long id, target string, optional cluster alias). A more accurate bound would divide bytes.length by the minimum bytes-per-entry (at least ~10 bytes) to prevent large allocations that pass the current check but still cannot be filled from the remaining payload. server/src/main/java/org/opensearch/action/search/TransportSearchHelper.java [108-112] int count = in.readVInt(); -if (count < 0 || count > bytes.length) { +// Each entry requires at least ~10 bytes (long id + two vint-prefixed strings); guard accordingly. +if (count < 0 || count > bytes.length / 10) { throw new IllegalArgumentException("Invalid scroll id"); } SearchContextIdForNode[] context = new SearchContextIdForNode[count]; Suggestion importance[1-10]: 6 __ Why: The suggestion is reasonable since each entry requires multiple bytes, so count > bytes.length is a loose bound. Tightening it would provide better protection, though the current check already prevents extreme OOM scenarios. The divisor of 10 is somewhat arbitrary but represents a meaningful improvement.	Low

[github-actions]

✅ Gradle check result for 01ada51: SUCCESS

[codecov]

Codecov Report

❌ Patch coverage is 75.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 72.00%. Comparing base (aff3489) to head (01ada51).
⚠️ Report is 15 commits behind head on 2.19.

Files with missing lines	Patch %	Lines
...pensearch/action/search/TransportSearchHelper.java	75.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               2.19   #22401      +/-   ##
============================================
+ Coverage     71.92%   72.00%   +0.07%     
+ Complexity    66009    64462    -1547     
============================================
  Files          5342     5121     -221     
  Lines        307392   300250    -7142     
  Branches      44862    44096     -766     
============================================
- Hits         221105   216180    -4925     
+ Misses        67823    65949    -1874     
+ Partials      18464    18121     -343     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.