SecurityIndexSearcherWrapper doesn't always carry over caches and sim…

…ilarity (#43436) If DocumentLevelSecurity is enabled SecurityIndexSearcherWrapper doesn't carry over the cache, cache policy and similarity from the incoming searcher.
elastic · Jun 21, 2019 · 424ef4f · 424ef4f
1 parent 059eb55
commit 424ef4f
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 5 deletions.
diff --git a/...g/elasticsearch/xpack/core/security/authz/accesscontrol/SecurityIndexSearcherWrapper.java b/...g/elasticsearch/xpack/core/security/authz/accesscontrol/SecurityIndexSearcherWrapper.java
@@ -124,11 +124,11 @@ protected IndexSearcher wrap(IndexSearcher searcher) throws EngineException {
             // The reasons why we return a custom searcher:
             // 1) in the case the role query is sparse then large part of the main query can be skipped
             // 2) If the role query doesn't match with any docs in a segment, that a segment can be skipped
-            IndexSearcher indexSearcher = new IndexSearcherWrapper((DocumentSubsetDirectoryReader) directoryReader);
-            indexSearcher.setQueryCache(indexSearcher.getQueryCache());
-            indexSearcher.setQueryCachingPolicy(indexSearcher.getQueryCachingPolicy());
-            indexSearcher.setSimilarity(indexSearcher.getSimilarity());
-            return indexSearcher;
+            IndexSearcher searcherWrapper = new IndexSearcherWrapper((DocumentSubsetDirectoryReader) directoryReader);
+            searcherWrapper.setQueryCache(searcher.getQueryCache());
+            searcherWrapper.setQueryCachingPolicy(searcher.getQueryCachingPolicy());
+            searcherWrapper.setSimilarity(searcher.getSimilarity());
+            return searcherWrapper;
         }
         return searcher;
     }

diff --git a/...search/xpack/core/security/authz/accesscontrol/SecurityIndexSearcherWrapperUnitTests.java b/...search/xpack/core/security/authz/accesscontrol/SecurityIndexSearcherWrapperUnitTests.java
@@ -19,12 +19,14 @@
 import org.apache.lucene.index.PostingsEnum;
 import org.apache.lucene.index.Term;
 import org.apache.lucene.index.TermsEnum;
+import org.apache.lucene.misc.SweetSpotSimilarity;
 import org.apache.lucene.search.BulkScorer;
 import org.apache.lucene.search.Explanation;
 import org.apache.lucene.search.IndexSearcher;
 import org.apache.lucene.search.LeafCollector;
 import org.apache.lucene.search.MatchAllDocsQuery;
 import org.apache.lucene.search.Query;
+import org.apache.lucene.search.QueryCachingPolicy;
 import org.apache.lucene.search.Scorer;
 import org.apache.lucene.search.TermQuery;
 import org.apache.lucene.search.Weight;
@@ -198,11 +200,25 @@ public void onRemoval(ShardId shardId, Accountable accountable) {
         });
         DirectoryReader directoryReader = DocumentSubsetReader.wrap(esIn, bitsetFilterCache, new MatchAllDocsQuery());
         IndexSearcher indexSearcher = new IndexSearcher(directoryReader);
+        indexSearcher.setSimilarity(new SweetSpotSimilarity());
+        indexSearcher.setQueryCachingPolicy(new QueryCachingPolicy() {
+            @Override
+            public void onUse(Query query) {
+            }
+
+            @Override
+            public boolean shouldCache(Query query) {
+                return false;
+            }
+        });
+        indexSearcher.setQueryCache((weight, policy) -> weight);
         securityIndexSearcherWrapper =
                 new SecurityIndexSearcherWrapper(null, null, threadContext, licenseState, scriptService);
         IndexSearcher result = securityIndexSearcherWrapper.wrap(indexSearcher);
         assertThat(result, not(sameInstance(indexSearcher)));
         assertThat(result.getSimilarity(), sameInstance(indexSearcher.getSimilarity()));
+        assertThat(result.getQueryCachingPolicy(), sameInstance(indexSearcher.getQueryCachingPolicy()));
+        assertThat(result.getQueryCache(), sameInstance(indexSearcher.getQueryCache()));
         bitsetFilterCache.close();
     }