add dnfof pattern

opensearch-project · Aug 6, 2021 · 01ea9ff · 01ea9ff
1 parent 0df0a67
commit 01ea9ff
Showing 1 changed file with 9 additions and 2 deletions.
diff --git a/src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java b/src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java
@@ -57,6 +57,7 @@
 import org.opensearch.action.admin.indices.mapping.get.GetFieldMappingsRequest;
 import org.opensearch.action.admin.indices.mapping.put.AutoPutMappingAction;
 import org.opensearch.action.admin.indices.mapping.put.PutMappingAction;
+import org.opensearch.action.admin.indices.resolve.ResolveIndexAction;
 import org.opensearch.action.bulk.BulkAction;
 import org.opensearch.action.bulk.BulkItemRequest;
 import org.opensearch.action.bulk.BulkRequest;
@@ -105,7 +106,6 @@
 public class PrivilegesEvaluator {
 
     private static final WildcardMatcher ACTION_MATCHER = WildcardMatcher.from("indices:data/read/*search*");
-    private static final Pattern dnfofPatterns = Pattern.compile("");
     protected final Logger log = LogManager.getLogger(this.getClass());
     private final ClusterService clusterService;
 
@@ -131,6 +131,13 @@ public class PrivilegesEvaluator {
     private final boolean dlsFlsEnabled;
     private DynamicConfigModel dcm;
 
+    private static final Pattern dnfofPatterns = Pattern.compile(
+            "indices:data/read/*" + "|" +
+            "indices:admin/mappings/fields/get*" + "|" +
+            "indices:admin/shards/search_shards" + "|" +
+            ResolveIndexAction.NAME
+    );
+
     public PrivilegesEvaluator(final ClusterService clusterService, final ThreadPool threadPool,
                                final ConfigurationRepository configurationRepository, final IndexNameExpressionResolver resolver,
                                AuditLog auditLog, final Settings settings, final PrivilegesInterceptor privilegesInterceptor, final ClusterInfoHolder clusterInfoHolder,
@@ -406,7 +413,7 @@ public PrivilegesEvaluatorResponse evaluate(final User user, String action0, fin
                     presponse.missingPrivileges.clear();
                     presponse.allowed = true;
 
-                    IndicesOptions idxOpt = IndicesOptions.fromOptions(true, true, false, false;
+                    IndicesOptions idxOpt = IndicesOptions.fromOptions(true, true, false, false);
                     if(request instanceof SearchRequest) {
                         ((SearchRequest) request).indicesOptions(idxOpt);
                     } else if(request instanceof ClusterSearchShardsRequest) {