script.allowed_contexts - unknown script context

[mohmad-null]

I have a config file that works file with 6.3.2 but when I try and upgrade to 7.2.0 I get this exception:

[2019-07-11T17:26:36,202][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [1node] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.IllegalArgumentException: unknown script context [search] found in setting [script.allowed_contexts].
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:163) ~[elasticsearch-7.2.0.jar:7.2.0]
        at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150) ~[elasticsearch-7.2.0.jar:7.2.0]
        at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-7.2.0.jar:7.2.0]
        at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~[elasticsearch-cli-7.2.0.jar:7.2.0]
        at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-7.2.0.jar:7.2.0]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115) ~[elasticsearch-7.2.0.jar:7.2.0]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) ~[elasticsearch-7.2.0.jar:7.2.0]
Caused by: java.lang.IllegalArgumentException: unknown script context [search] found in setting [script.allowed_contexts].
        at org.elasticsearch.script.ScriptService.<init>(ScriptService.java:209) ~[elasticsearch-7.2.0.jar:7.2.0]
        at org.elasticsearch.script.ScriptModule.<init>(ScriptModule.java:92) ~[elasticsearch-7.2.0.jar:7.2.0]
        at org.elasticsearch.node.Node.<init>(Node.java:331) ~[elasticsearch-7.2.0.jar:7.2.0]
        at org.elasticsearch.node.Node.<init>(Node.java:251) ~[elasticsearch-7.2.0.jar:7.2.0]
        at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:221) ~[elasticsearch-7.2.0.jar:7.2.0]
        at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[elasticsearch-7.2.0.jar:7.2.0]
        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.2.0.jar:7.2.0]
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.2.0.jar:7.2.0]
        ... 6 more

The pertinent lines are:

# Limit scripting. "inline" is necessary for custom scoring.
script.allowed_types: inline
# Only allow scripts to be used for searching
script.allowed_contexts: search

If I remove script.allowed_contexts line then 7.2.0 starts fine. Except that this is documented as being correct: https://www.elastic.co/guide/en/elasticsearch/reference/7.2/modules-scripting-security.html
No plugins.

[mohmad-null]

script.allowed_contexts: update - starts fine. Except I don't want update, I want search

[mohmad-null]

Related docs issue - there doesn't seem to be any docs page anywhere stating what the actual permitted values for these settings is.

[elasticmachine]

Pinging @elastic/es-core-infra

[elasticmachine]

Pinging @elastic/es-docs

[rjernst]

Thanks very much for your interest in Elasticsearch.

The name of the scoring script context changed in 6.4. See #30816.

We'd like to direct these kinds of issues to the forums. If you can stop by there, we'd appreciate it. There is an active community there that should be able to help get an answers to your questions. This allows us to use GitHub for verified bug reports, feature requests, and pull requests. As such, I hope you don't mind that I close this.

[rjernst]

For additional context, we do have the contexts documented, but we currently lack the name associated with each context.

[mohmad-null]

@rjernst - Thanks but this remains a bug albeit in the documentation apparently. The docs are explicitly wrong which is why I reported it here rather than asked in the forum. I can see the following issues with the docs:

• They explicitly state an invalid value as an example
• No reference to the deprecation/change on that docs page or the provided painless contexts page
• It's not even slightly clear from the new "painless contexts" page what they're on about. Which one(s) is/are required for a basic "search"? Do you expect users to test every possible combination? I'd suggest it's a bad idea to require users to have a deep understanding of how ES processes queries if they want to set up decent security - the more bars there are for security, the less likely people will engage with it.
• There's no link to the "painless contexts" from the security page.

[rjernst]

@mohmad-null Apologies, I see your point now. I am reopening to fix this.