github-mirrors/elasticsearch
1
0
Fork 0
mirror of https://github.com/elastic/elasticsearch.git synced 2025-06-28 17:34:17 -04:00
Code Issues Projects Releases Packages Wiki Activity

Remove support for mulitple languages per scripting engine

Browse source
This commit is contained in:
Lee Hinman 2016-05-11 08:06:07 -06:00
parent a4060f7436
commit efff3918d8
50 changed files with 336 additions and 353 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/reference/modules/scripting/groovy.asciidoc
View file

@ -1,9 +1,9 @@
[[modules-scripting-groovy]]
=== Groovy Scripting Language
Groovy is the default scripting language available in Elasticsearch. Although
limited by the <<java-security-manager,Java Security Manager>>, only `file`
scripts may be used by default.
Groovy is the default scripting language available in Elasticsearch. Although
limited by the <<java-security-manager,Java Security Manager>>, it is not a
sandboxed language and only `file` scripts may be used by default.
Enabling `inline` or `stored` Groovy scripting is a security risk and should
only be considered if your Elasticsearch cluster is protected from the outside

13
docs/reference/modules/scripting/security.asciidoc
View file

@ -64,9 +64,10 @@ script.file: true
-----------------------------------
NOTE: Global scripting settings affect the `mustache` scripting language.
<<search-template,Search templates>> internally use the `mustache` language, and
will be disabled by default, but they can be enabled/disabled according to
fine-grained settings specified in `elasticsearch.yml`.
<<search-template,Search templates>> internally use the `mustache` language,
and will still be enabled by default as the `mustache` engine is sandboxed,
but they will be enabled/disabled according to fine-grained settings
specified in `elasticsearch.yml`.
[[security-script-context]]
[float]
@ -86,9 +87,9 @@ of using the generic `plugin` category. Those operations can be referred to
in the following form: `${pluginName}_${operation}`.
The following example disables scripting for `update` and `plugin` operations,
regardless of the script source or language. Scripts can be executed from
languages as part of `aggregations`, `search` and plugins execution though,
assuming they are enabled in the scripting settings.
regardless of the script source or language. Scripts can still be executed
from sandboxed languages as part of `aggregations`, `search` and plugins
execution though, as the above defaults still get applied.
[source,yaml]
-----------------------------------

16
docs/reference/modules/scripting/using.asciidoc
View file

@ -110,15 +110,15 @@ second version is only compiled once.
[[modules-scripting-file-scripts]]
=== File-based Scripts
To increase security, scripts for languages that are not deemed to be safe by
default can only be specified in files stored on every node in the cluster. File
scripts must be saved in the `scripts` directory whose default location depends
on whether you use the <<zip-targz-layout,`zip`/`tar.gz`>>
(`$ES_HOME/config/scripts/`), <<rpm-layout,RPM>>, or <<deb-layout,Debian>>
package. The default may be changed with the `path.script` setting.
To increase security, non-sandboxed languages can only be specified in script
files stored on every node in the cluster. File scripts must be saved in the
`scripts` directory whose default location depends on whether you use the
<<zip-targz-layout,`zip`/`tar.gz`>> (`$ES_HOME/config/scripts/`),
<<rpm-layout,RPM>>, or <<deb-layout,Debian>> package. The default may be
changed with the `path.script` setting.
The languages which are assumed to be safe by default are: painless,
expressions, and mustache (used for query templates).
The languages which are assumed to be safe by default are: `painless`,
`expression`, and `mustache` (used for search and query templates).
Any files placed in the `scripts` directory will be compiled automatically
when the node starts up and then <<reload-scripts,every 60 seconds thereafter>>.