diff --git a/build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/toolchain/AdoptiumJdkToolchainResolver.java b/build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/toolchain/AdoptiumJdkToolchainResolver.java index bddf95cae77d4..388254e400229 100644 --- a/build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/toolchain/AdoptiumJdkToolchainResolver.java +++ b/build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/toolchain/AdoptiumJdkToolchainResolver.java @@ -10,6 +10,8 @@ import com.fasterxml.jackson.databind.JsonNode; import com.fasterxml.jackson.databind.ObjectMapper; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.apache.commons.compress.utils.Lists; import org.gradle.jvm.toolchain.JavaLanguageVersion; @@ -58,8 +60,7 @@ private Optional resolveAvailableVersion(AdoptiumVersionReq ObjectMapper mapper = new ObjectMapper(); try { int languageVersion = requestKey.languageVersion.asInt(); - URL source = new URL( - "https://api.adoptium.net/v3/info/release_versions?architecture=" + URL source = Urls.create("https://api.adoptium.net/v3/info/release_versions?architecture=" + requestKey.arch + "&image_type=jdk&os=" + requestKey.platform @@ -68,8 +69,7 @@ private Optional resolveAvailableVersion(AdoptiumVersionReq + languageVersion + "," + (languageVersion + 1) - + ")" - ); + + ")", Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS); JsonNode jsonNode = mapper.readTree(source); JsonNode versionsNode = jsonNode.get("versions"); return Optional.of( diff --git a/build-tools/src/main/java/org/elasticsearch/gradle/testclusters/WaitForHttpResource.java b/build-tools/src/main/java/org/elasticsearch/gradle/testclusters/WaitForHttpResource.java index 550dd0fdcf8fb..42763e636ce1b 100644 --- a/build-tools/src/main/java/org/elasticsearch/gradle/testclusters/WaitForHttpResource.java +++ b/build-tools/src/main/java/org/elasticsearch/gradle/testclusters/WaitForHttpResource.java @@ -8,6 +8,8 @@ package org.elasticsearch.gradle.testclusters; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.gradle.api.logging.Logger; import org.gradle.api.logging.Logging; @@ -44,7 +46,7 @@ public class WaitForHttpResource { private String password; public WaitForHttpResource(String protocol, String host, int numberOfNodes) throws MalformedURLException { - this(new URL(protocol + "://" + host + "/_cluster/health?wait_for_nodes=>=" + numberOfNodes + "&wait_for_status=yellow")); + this(Urls.create(protocol + "://" + host + "/_cluster/health?wait_for_nodes=>=" + numberOfNodes + "&wait_for_status=yellow", Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS)); } public WaitForHttpResource(URL url) { diff --git a/distribution/tools/plugin-cli/src/main/java/org/elasticsearch/plugins/cli/InstallPluginAction.java b/distribution/tools/plugin-cli/src/main/java/org/elasticsearch/plugins/cli/InstallPluginAction.java index c7bee4a6c172d..9522bb075e9ec 100644 --- a/distribution/tools/plugin-cli/src/main/java/org/elasticsearch/plugins/cli/InstallPluginAction.java +++ b/distribution/tools/plugin-cli/src/main/java/org/elasticsearch/plugins/cli/InstallPluginAction.java @@ -8,6 +8,8 @@ package org.elasticsearch.plugins.cli; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.apache.lucene.search.spell.LevenshteinDistance; import org.apache.lucene.util.CollectionUtil; import org.apache.lucene.util.Constants; @@ -434,7 +436,7 @@ private String getMavenUrl(String[] coordinates) throws IOException { @SuppressForbidden(reason = "Make HEAD request using URLConnection.connect()") boolean urlExists(String urlString) throws IOException { terminal.println(VERBOSE, "Checking if url exists: " + urlString); - URL url = new URL(urlString); + URL url = Urls.create(urlString, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS); assert "https".equals(url.getProtocol()) : "Only http urls can be checked"; HttpURLConnection urlConnection = (HttpURLConnection) url.openConnection(); urlConnection.addRequestProperty("User-Agent", "elasticsearch-plugin-installer"); @@ -464,7 +466,7 @@ private static List checkMisspelledPlugin(String pluginId) { @SuppressForbidden(reason = "We use getInputStream to download plugins") Path downloadZip(String urlString, Path tmpDir) throws IOException { terminal.println(VERBOSE, "Retrieving zip from " + urlString); - URL url = new URL(urlString); + URL url = Urls.create(urlString, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS); Path zip = Files.createTempFile(tmpDir, null, ".zip"); URLConnection urlConnection = this.proxy == null ? url.openConnection() : url.openConnection(this.proxy); urlConnection.addRequestProperty("User-Agent", "elasticsearch-plugin-installer"); @@ -760,7 +762,7 @@ InputStream getPublicKey() { */ // pkg private for tests URL openUrl(String urlString) throws IOException { - URL checksumUrl = new URL(urlString); + URL checksumUrl = Urls.create(urlString, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS); HttpURLConnection connection = this.proxy == null ? (HttpURLConnection) checksumUrl.openConnection() : (HttpURLConnection) checksumUrl.openConnection(this.proxy); diff --git a/libs/core/src/main/java/org/elasticsearch/core/internal/provider/EmbeddedImplClassLoader.java b/libs/core/src/main/java/org/elasticsearch/core/internal/provider/EmbeddedImplClassLoader.java index 049b619fb57ac..2fb90e8ac62c0 100644 --- a/libs/core/src/main/java/org/elasticsearch/core/internal/provider/EmbeddedImplClassLoader.java +++ b/libs/core/src/main/java/org/elasticsearch/core/internal/provider/EmbeddedImplClassLoader.java @@ -8,6 +8,8 @@ package org.elasticsearch.core.internal.provider; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import java.io.BufferedReader; import java.io.IOException; import java.io.InputStream; @@ -466,7 +468,7 @@ private static Map getProviderPrefixes(ClassLoader parent, } private static CodeSource codeSource(URL baseURL, String jarName) throws MalformedURLException { - return new CodeSource(new URL(baseURL, jarName), (CodeSigner[]) null /*signers*/); + return new CodeSource(Urls.create(baseURL, jarName, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS), (CodeSigner[]) null /*signers*/); } private static boolean isMultiRelease(ClassLoader parent, String jarPrefix) throws IOException { diff --git a/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/UriPartsProcessor.java b/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/UriPartsProcessor.java index 2a7025a02ac30..953476e38a7f2 100644 --- a/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/UriPartsProcessor.java +++ b/modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/UriPartsProcessor.java @@ -8,6 +8,8 @@ package org.elasticsearch.ingest.common; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.elasticsearch.core.SuppressForbidden; import org.elasticsearch.ingest.AbstractProcessor; import org.elasticsearch.ingest.ConfigurationUtils; @@ -94,7 +96,7 @@ public static Map apply(String urlString) { uri = new URI(urlString); } catch (URISyntaxException e) { try { - url = new URL(urlString); + url = Urls.create(urlString, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS); } catch (MalformedURLException e2) { throw new IllegalArgumentException("unable to parse URI [" + urlString + "]"); } diff --git a/modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/HttpClient.java b/modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/HttpClient.java index 188d826b05ff5..2edb82290626d 100644 --- a/modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/HttpClient.java +++ b/modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/HttpClient.java @@ -8,6 +8,8 @@ package org.elasticsearch.ingest.geoip; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.elasticsearch.ElasticsearchStatusException; import org.elasticsearch.ResourceNotFoundException; import org.elasticsearch.SpecialPermission; @@ -53,8 +55,8 @@ InputStream get(String urlToGet) throws IOException { throw new IllegalStateException("too many redirects connection to [" + urlToGet + "]"); } String location = conn.getHeaderField("Location"); - URL base = new URL(url); - URL next = new URL(base, location); // Deal with relative URLs + URL base = Urls.create(url, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS); + URL next = Urls.create(base, location, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS); // Deal with relative URLs url = next.toExternalForm(); conn = createConnection(url); break; @@ -74,7 +76,7 @@ private static InputStream getInputStream(HttpURLConnection conn) throws IOExcep } private static HttpURLConnection createConnection(String url) throws IOException { - HttpURLConnection conn = (HttpURLConnection) new URL(url).openConnection(); + HttpURLConnection conn = (HttpURLConnection) Urls.create(url, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS).openConnection(); conn.setConnectTimeout(10000); conn.setReadTimeout(10000); conn.setDoOutput(false); diff --git a/modules/lang-painless/src/doc/java/org/elasticsearch/painless/ContextGeneratorCommon.java b/modules/lang-painless/src/doc/java/org/elasticsearch/painless/ContextGeneratorCommon.java index c54214e5f854d..87d096f8e9b2c 100644 --- a/modules/lang-painless/src/doc/java/org/elasticsearch/painless/ContextGeneratorCommon.java +++ b/modules/lang-painless/src/doc/java/org/elasticsearch/painless/ContextGeneratorCommon.java @@ -8,6 +8,8 @@ package org.elasticsearch.painless; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.elasticsearch.core.SuppressForbidden; import org.elasticsearch.painless.action.PainlessContextClassBindingInfo; import org.elasticsearch.painless.action.PainlessContextClassInfo; @@ -35,7 +37,7 @@ public class ContextGeneratorCommon { @SuppressForbidden(reason = "retrieving data from an internal API not exposed as part of the REST client") public static List getContextInfos() throws IOException { - URLConnection getContextNames = new URL("http://" + System.getProperty("cluster.uri") + "/_scripts/painless/_context") + URLConnection getContextNames = Urls.create("http://" + System.getProperty("cluster.uri") + "/_scripts/painless/_context", Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS) .openConnection(); XContentParser parser = JsonXContent.jsonXContent.createParser(XContentParserConfiguration.EMPTY, getContextNames.getInputStream()); parser.nextToken(); @@ -48,9 +50,7 @@ public static List getContextInfos() throws IOException { List contextInfos = new ArrayList<>(); for (String contextName : contextNames) { - URLConnection getContextInfo = new URL( - "http://" + System.getProperty("cluster.uri") + "/_scripts/painless/_context?context=" + contextName - ).openConnection(); + URLConnection getContextInfo = Urls.create("http://" + System.getProperty("cluster.uri") + "/_scripts/painless/_context?context=" + contextName, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS).openConnection(); parser = JsonXContent.jsonXContent.createParser(XContentParserConfiguration.EMPTY, getContextInfo.getInputStream()); contextInfos.add(PainlessContextInfo.fromXContent(parser)); ((HttpURLConnection) getContextInfo).disconnect(); diff --git a/modules/lang-painless/src/main/java/org/elasticsearch/painless/Compiler.java b/modules/lang-painless/src/main/java/org/elasticsearch/painless/Compiler.java index 3c31a962d841b..c9a7a2079cad8 100644 --- a/modules/lang-painless/src/main/java/org/elasticsearch/painless/Compiler.java +++ b/modules/lang-painless/src/main/java/org/elasticsearch/painless/Compiler.java @@ -8,6 +8,8 @@ package org.elasticsearch.painless; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.elasticsearch.bootstrap.BootstrapInfo; import org.elasticsearch.painless.antlr.Walker; import org.elasticsearch.painless.ir.ClassNode; @@ -60,7 +62,7 @@ final class Compiler { static { try { // Setup the code privileges. - CODESOURCE = new CodeSource(new URL("file:" + BootstrapInfo.UNTRUSTED_CODEBASE), (Certificate[]) null); + CODESOURCE = new CodeSource(Urls.create("file:" + BootstrapInfo.UNTRUSTED_CODEBASE, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS), (Certificate[]) null); } catch (MalformedURLException impossible) { throw new RuntimeException(impossible); } diff --git a/modules/repository-gcs/src/main/java/org/elasticsearch/repositories/gcs/GoogleCloudStorageService.java b/modules/repository-gcs/src/main/java/org/elasticsearch/repositories/gcs/GoogleCloudStorageService.java index 760c1c57e0496..61b3c06d81822 100644 --- a/modules/repository-gcs/src/main/java/org/elasticsearch/repositories/gcs/GoogleCloudStorageService.java +++ b/modules/repository-gcs/src/main/java/org/elasticsearch/repositories/gcs/GoogleCloudStorageService.java @@ -20,6 +20,8 @@ import com.google.cloud.storage.Storage; import com.google.cloud.storage.StorageOptions; import com.google.cloud.storage.StorageRetryStrategy; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; @@ -244,7 +246,7 @@ static String getDefaultProjectId(@Nullable Proxy proxy) throws IOException { if (metaHost == null) { metaHost = "metadata.google.internal"; } - URL url = new URL("http://" + metaHost + "/computeMetadata/v1/project/project-id"); + URL url = Urls.create("http://" + metaHost + "/computeMetadata/v1/project/project-id", Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS); HttpURLConnection connection = (HttpURLConnection) (proxy != null ? url.openConnection(proxy) : url.openConnection()); connection.setConnectTimeout(5000); connection.setReadTimeout(5000); diff --git a/modules/repository-url/src/main/java/org/elasticsearch/common/blobstore/url/URLBlobContainer.java b/modules/repository-url/src/main/java/org/elasticsearch/common/blobstore/url/URLBlobContainer.java index c33e1519e8a28..a26c5fe0394d8 100644 --- a/modules/repository-url/src/main/java/org/elasticsearch/common/blobstore/url/URLBlobContainer.java +++ b/modules/repository-url/src/main/java/org/elasticsearch/common/blobstore/url/URLBlobContainer.java @@ -8,6 +8,8 @@ package org.elasticsearch.common.blobstore.url; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.elasticsearch.action.ActionListener; import org.elasticsearch.common.blobstore.BlobContainer; import org.elasticsearch.common.blobstore.BlobPath; @@ -110,7 +112,7 @@ public DeleteResult delete(OperationPurpose purpose) { @Override public InputStream readBlob(OperationPurpose purpose, String name) throws IOException { try { - return new BufferedInputStream(getInputStream(new URL(path, name)), blobStore.bufferSizeInBytes()); + return new BufferedInputStream(getInputStream(Urls.create(path, name, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS)), blobStore.bufferSizeInBytes()); } catch (FileNotFoundException fnfe) { throw new NoSuchFileException("blob object [" + name + "] not found"); } diff --git a/modules/repository-url/src/main/java/org/elasticsearch/common/blobstore/url/URLBlobStore.java b/modules/repository-url/src/main/java/org/elasticsearch/common/blobstore/url/URLBlobStore.java index 0a6a7c22e79e5..a92e4583e4688 100644 --- a/modules/repository-url/src/main/java/org/elasticsearch/common/blobstore/url/URLBlobStore.java +++ b/modules/repository-url/src/main/java/org/elasticsearch/common/blobstore/url/URLBlobStore.java @@ -8,6 +8,8 @@ package org.elasticsearch.common.blobstore.url; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.elasticsearch.common.blobstore.BlobContainer; import org.elasticsearch.common.blobstore.BlobPath; import org.elasticsearch.common.blobstore.BlobStore; @@ -129,9 +131,9 @@ private URL buildPath(BlobPath relativePath) throws MalformedURLException { if (paths.isEmpty()) { return path(); } - URL blobPath = new URL(this.path, paths.get(0) + "/"); + URL blobPath = Urls.create(this.path, paths.get(0) + "/", Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS); for (int i = 1; i < paths.size(); i++) { - blobPath = new URL(blobPath, paths.get(i) + "/"); + blobPath = Urls.create(blobPath, paths.get(i) + "/", Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS); } return blobPath; } diff --git a/modules/repository-url/src/main/java/org/elasticsearch/common/blobstore/url/http/HttpURLBlobContainer.java b/modules/repository-url/src/main/java/org/elasticsearch/common/blobstore/url/http/HttpURLBlobContainer.java index 186c119d78230..ec9284307a08b 100644 --- a/modules/repository-url/src/main/java/org/elasticsearch/common/blobstore/url/http/HttpURLBlobContainer.java +++ b/modules/repository-url/src/main/java/org/elasticsearch/common/blobstore/url/http/HttpURLBlobContainer.java @@ -8,6 +8,8 @@ package org.elasticsearch.common.blobstore.url.http; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.elasticsearch.common.blobstore.BlobPath; import org.elasticsearch.common.blobstore.OperationPurpose; import org.elasticsearch.common.blobstore.url.URLBlobContainer; @@ -58,7 +60,7 @@ public InputStream readBlob(OperationPurpose purpose, String name) throws IOExce private URI getURIForBlob(String name) throws IOException { try { - return new URL(path, name).toURI(); + return Urls.create(path, name, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS).toURI(); } catch (Exception e) { throw new IOException("Unable to get an URI for blob with name [" + name + "]", e); } diff --git a/modules/repository-url/src/main/java/org/elasticsearch/repositories/url/URLRepository.java b/modules/repository-url/src/main/java/org/elasticsearch/repositories/url/URLRepository.java index db68ecf93e4b7..799a83eafa51c 100644 --- a/modules/repository-url/src/main/java/org/elasticsearch/repositories/url/URLRepository.java +++ b/modules/repository-url/src/main/java/org/elasticsearch/repositories/url/URLRepository.java @@ -8,6 +8,8 @@ package org.elasticsearch.repositories.url; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; import org.elasticsearch.cluster.metadata.RepositoryMetadata; @@ -177,7 +179,7 @@ public boolean isReadOnly() { private static URL parseURL(String s) { try { - return new URL(s); + return Urls.create(s, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS); } catch (MalformedURLException e) { throw new IllegalArgumentException("Unable to parse URL repository setting", e); } diff --git a/modules/repository-url/src/yamlRestTest/java/org/elasticsearch/repositories/url/RepositoryURLClientYamlTestSuiteIT.java b/modules/repository-url/src/yamlRestTest/java/org/elasticsearch/repositories/url/RepositoryURLClientYamlTestSuiteIT.java index 0958276656a81..df149bb28bf80 100644 --- a/modules/repository-url/src/yamlRestTest/java/org/elasticsearch/repositories/url/RepositoryURLClientYamlTestSuiteIT.java +++ b/modules/repository-url/src/yamlRestTest/java/org/elasticsearch/repositories/url/RepositoryURLClientYamlTestSuiteIT.java @@ -10,6 +10,8 @@ import com.carrotsearch.randomizedtesting.annotations.Name; import com.carrotsearch.randomizedtesting.annotations.ParametersFactory; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.apache.http.HttpEntity; import org.apache.http.entity.ContentType; @@ -95,7 +97,7 @@ public void registerRepositories() throws IOException { List allowedUrls = (List) XContentMapValues.extractValue("defaults.repositories.url.allowed_urls", clusterSettings); for (String allowedUrl : allowedUrls) { try { - InetAddress inetAddress = InetAddress.getByName(new URL(allowedUrl).getHost()); + InetAddress inetAddress = InetAddress.getByName(Urls.create(allowedUrl, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS).getHost()); if (inetAddress.isAnyLocalAddress() || inetAddress.isLoopbackAddress()) { Request createUrlRepositoryRequest = new Request("PUT", "/_snapshot/repository-url"); createUrlRepositoryRequest.setEntity(buildRepositorySettings("url", Settings.builder().put("url", allowedUrl).build())); diff --git a/plugins/discovery-ec2/src/main/java/org/elasticsearch/discovery/ec2/AwsEc2Utils.java b/plugins/discovery-ec2/src/main/java/org/elasticsearch/discovery/ec2/AwsEc2Utils.java index 256a5516a2ef2..7e983ea64ff88 100644 --- a/plugins/discovery-ec2/src/main/java/org/elasticsearch/discovery/ec2/AwsEc2Utils.java +++ b/plugins/discovery-ec2/src/main/java/org/elasticsearch/discovery/ec2/AwsEc2Utils.java @@ -8,6 +8,8 @@ package org.elasticsearch.discovery.ec2; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; import org.elasticsearch.common.Strings; @@ -37,7 +39,7 @@ static Optional getMetadataToken(String metadataTokenUrl) { return SocketAccess.doPrivileged(() -> { HttpURLConnection urlConnection; try { - urlConnection = (HttpURLConnection) new URL(metadataTokenUrl).openConnection(); + urlConnection = (HttpURLConnection) Urls.create(metadataTokenUrl, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS).openConnection(); urlConnection.setRequestMethod("PUT"); urlConnection.setConnectTimeout(CONNECT_TIMEOUT); urlConnection.setRequestProperty("X-aws-ec2-metadata-token-ttl-seconds", String.valueOf(METADATA_TOKEN_TTL_SECONDS)); diff --git a/plugins/discovery-ec2/src/main/java/org/elasticsearch/discovery/ec2/Ec2DiscoveryPlugin.java b/plugins/discovery-ec2/src/main/java/org/elasticsearch/discovery/ec2/Ec2DiscoveryPlugin.java index 69447e800d4ac..67f94dc622c9e 100644 --- a/plugins/discovery-ec2/src/main/java/org/elasticsearch/discovery/ec2/Ec2DiscoveryPlugin.java +++ b/plugins/discovery-ec2/src/main/java/org/elasticsearch/discovery/ec2/Ec2DiscoveryPlugin.java @@ -10,6 +10,8 @@ import com.amazonaws.util.EC2MetadataUtils; import com.amazonaws.util.json.Jackson; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.elasticsearch.SpecialPermission; import org.elasticsearch.common.network.NetworkService; @@ -142,7 +144,7 @@ static Settings getAvailabilityZoneNodeAttributes(Settings settings, String azMe final URL url; final URLConnection urlConnection; try { - url = new URL(azMetadataUrl); + url = Urls.create(azMetadataUrl, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS); logger.debug("obtaining ec2 [placement/availability-zone] from ec2 meta-data url {}", url); urlConnection = SocketAccess.doPrivilegedIOException(url::openConnection); urlConnection.setConnectTimeout(2000); diff --git a/plugins/discovery-ec2/src/main/java/org/elasticsearch/discovery/ec2/Ec2NameResolver.java b/plugins/discovery-ec2/src/main/java/org/elasticsearch/discovery/ec2/Ec2NameResolver.java index 5c8a2a8fb92f9..3ad9a021ce9d8 100644 --- a/plugins/discovery-ec2/src/main/java/org/elasticsearch/discovery/ec2/Ec2NameResolver.java +++ b/plugins/discovery-ec2/src/main/java/org/elasticsearch/discovery/ec2/Ec2NameResolver.java @@ -9,6 +9,8 @@ package org.elasticsearch.discovery.ec2; import com.amazonaws.util.EC2MetadataUtils; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.elasticsearch.common.network.NetworkService.CustomNameResolver; import org.elasticsearch.core.IOUtils; @@ -85,7 +87,7 @@ public static InetAddress[] resolve(Ec2HostnameType type) throws IOException { String metadataUrl = EC2MetadataUtils.getHostAddressForEC2MetadataService() + "/latest/meta-data/" + type.ec2Name; String metadataTokenUrl = EC2MetadataUtils.getHostAddressForEC2MetadataService() + "/latest/api/token"; try { - URL url = new URL(metadataUrl); + URL url = Urls.create(metadataUrl, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS); logger.debug("obtaining ec2 hostname from ec2 meta-data url {}", url); URLConnection urlConnection = SocketAccess.doPrivilegedIOException(url::openConnection); urlConnection.setConnectTimeout(2000); diff --git a/server/src/main/java/org/elasticsearch/env/Environment.java b/server/src/main/java/org/elasticsearch/env/Environment.java index 2f738eb1412a5..af9f985f7bb60 100644 --- a/server/src/main/java/org/elasticsearch/env/Environment.java +++ b/server/src/main/java/org/elasticsearch/env/Environment.java @@ -8,6 +8,8 @@ package org.elasticsearch.env; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.apache.lucene.util.Constants; import org.elasticsearch.common.settings.Setting; import org.elasticsearch.common.settings.Setting.Property; @@ -214,7 +216,7 @@ public URL resolveRepoURL(URL url) { } String jarTail = file.substring(pos); String filePath = file.substring(0, pos); - URL internalUrl = new URL(filePath); + URL internalUrl = Urls.create(filePath, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS); URL normalizedUrl = resolveRepoURL(internalUrl); if (normalizedUrl == null) { return null; diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/CommandLineHttpClient.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/CommandLineHttpClient.java index ca30f9f7ac7e8..de40cecdb180d 100644 --- a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/CommandLineHttpClient.java +++ b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/CommandLineHttpClient.java @@ -6,6 +6,8 @@ */ package org.elasticsearch.xpack.core.security; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.elasticsearch.common.CheckedSupplier; import org.elasticsearch.common.Strings; import org.elasticsearch.common.hash.MessageDigests; @@ -266,7 +268,7 @@ public static String getErrorCause(HttpResponse httpResponse) { * If status is 'Red', we will wait for 'Yellow' for 30s (default timeout) */ public void checkClusterHealthWithRetriesWaitingForCluster(String username, SecureString password, int retries) throws Exception { - final URL clusterHealthUrl = createURL(new URL(getDefaultURL()), "_cluster/health", "?wait_for_status=yellow&pretty"); + final URL clusterHealthUrl = createURL(Urls.create(getDefaultURL(), Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS), "_cluster/health", "?wait_for_status=yellow&pretty"); HttpResponse response; try { response = execute("GET", clusterHealthUrl, username, password, () -> null, CommandLineHttpClient::responseBuilder); @@ -318,7 +320,7 @@ public static HttpResponse.HttpResponseBuilder responseBuilder(InputStream is) t } public static URL createURL(URL url, String path, String query) throws MalformedURLException, URISyntaxException { - return new URL(url, (url.toURI().getPath() + path).replaceAll("/+", "/") + query); + return Urls.create(url, (url.toURI().getPath() + path).replaceAll("/+", "/") + query, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS); } public static String apiKeyHeaderValue(SecureString apiKey) { diff --git a/x-pack/plugin/identity-provider/src/internalClusterTest/java/org/elasticsearch/xpack/idp/action/SamlIdentityProviderTests.java b/x-pack/plugin/identity-provider/src/internalClusterTest/java/org/elasticsearch/xpack/idp/action/SamlIdentityProviderTests.java index 76bf415fdcce5..4affa77982911 100644 --- a/x-pack/plugin/identity-provider/src/internalClusterTest/java/org/elasticsearch/xpack/idp/action/SamlIdentityProviderTests.java +++ b/x-pack/plugin/identity-provider/src/internalClusterTest/java/org/elasticsearch/xpack/idp/action/SamlIdentityProviderTests.java @@ -7,6 +7,8 @@ package org.elasticsearch.xpack.idp.action; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.elasticsearch.ElasticsearchException; import org.elasticsearch.client.Request; import org.elasticsearch.client.RequestOptions; @@ -171,7 +173,7 @@ public void testSpInitiatedSso() throws Exception { final boolean forceAuthn = true; final AuthnRequest authnRequest = buildAuthnRequest( entityId, - new URL(acsUrl), + Urls.create(acsUrl, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS), new URL("https://idp.org/sso/redirect"), nameIdFormat, forceAuthn @@ -240,7 +242,7 @@ public void testSpInitiatedSsoFailsForUserWithNoAccess() throws Exception { final boolean forceAuthn = true; final AuthnRequest authnRequest = buildAuthnRequest( entityId, - new URL(acsUrl), + Urls.create(acsUrl, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS), new URL("https://idp.org/sso/redirect"), nameIdFormat, forceAuthn @@ -307,7 +309,7 @@ public void testSpInitiatedSsoFailsForUnknownSp() throws Exception { final boolean forceAuthn = randomBoolean(); final AuthnRequest authnRequest = buildAuthnRequest( entityId + randomAlphaOfLength(4), - new URL(acsUrl), + Urls.create(acsUrl, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS), new URL("https://idp.org/sso/redirect"), nameIdFormat, forceAuthn @@ -332,7 +334,7 @@ public void testSpInitiatedSsoFailsForMalformedRequest() throws Exception { final boolean forceAuthn = randomBoolean(); final AuthnRequest authnRequest = buildAuthnRequest( entityId + randomAlphaOfLength(4), - new URL(acsUrl), + Urls.create(acsUrl, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS), new URL("https://idp.org/sso/redirect"), nameIdFormat, forceAuthn diff --git a/x-pack/plugin/identity-provider/src/main/java/org/elasticsearch/xpack/idp/action/PutSamlServiceProviderRequest.java b/x-pack/plugin/identity-provider/src/main/java/org/elasticsearch/xpack/idp/action/PutSamlServiceProviderRequest.java index 930bfc512e736..d45fe52ab71a5 100644 --- a/x-pack/plugin/identity-provider/src/main/java/org/elasticsearch/xpack/idp/action/PutSamlServiceProviderRequest.java +++ b/x-pack/plugin/identity-provider/src/main/java/org/elasticsearch/xpack/idp/action/PutSamlServiceProviderRequest.java @@ -7,6 +7,8 @@ package org.elasticsearch.xpack.idp.action; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.elasticsearch.ElasticsearchParseException; import org.elasticsearch.action.ActionRequest; import org.elasticsearch.action.ActionRequestValidationException; @@ -100,7 +102,7 @@ public ActionRequestValidationException validate() { if (Strings.hasText(document.acs)) { // if this is blank the document validation will fail try { - final URL url = new URL(document.acs); + final URL url = Urls.create(document.acs, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS); if (url.getProtocol().equals("https") == false) { validationException = addValidationError( "[" + SamlServiceProviderDocument.Fields.ACS + "] must use the [https] protocol", diff --git a/x-pack/plugin/identity-provider/src/main/java/org/elasticsearch/xpack/idp/saml/idp/SamlIdentityProviderBuilder.java b/x-pack/plugin/identity-provider/src/main/java/org/elasticsearch/xpack/idp/saml/idp/SamlIdentityProviderBuilder.java index 8051b08c78a86..32f538ced2bb8 100644 --- a/x-pack/plugin/identity-provider/src/main/java/org/elasticsearch/xpack/idp/saml/idp/SamlIdentityProviderBuilder.java +++ b/x-pack/plugin/identity-provider/src/main/java/org/elasticsearch/xpack/idp/saml/idp/SamlIdentityProviderBuilder.java @@ -7,6 +7,8 @@ package org.elasticsearch.xpack.idp.saml.idp; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.elasticsearch.ElasticsearchSecurityException; import org.elasticsearch.common.Strings; import org.elasticsearch.common.ValidationException; @@ -293,7 +295,7 @@ public SamlIdentityProviderBuilder organization(SamlIdentityProvider.Organizatio private static URL parseUrl(String key, String value) { try { - return new URL(value); + return Urls.create(value, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS); } catch (MalformedURLException e) { throw new IllegalArgumentException("Invalid value [" + value + "] for [" + key + "]. Not a valid URL", e); } diff --git a/x-pack/plugin/identity-provider/src/main/java/org/elasticsearch/xpack/idp/saml/sp/SamlServiceProviderFactory.java b/x-pack/plugin/identity-provider/src/main/java/org/elasticsearch/xpack/idp/saml/sp/SamlServiceProviderFactory.java index 25a3ae59f17fd..513b2000e2989 100644 --- a/x-pack/plugin/identity-provider/src/main/java/org/elasticsearch/xpack/idp/saml/sp/SamlServiceProviderFactory.java +++ b/x-pack/plugin/identity-provider/src/main/java/org/elasticsearch/xpack/idp/saml/sp/SamlServiceProviderFactory.java @@ -7,6 +7,8 @@ package org.elasticsearch.xpack.idp.saml.sp; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.elasticsearch.xpack.idp.privileges.ServiceProviderPrivileges; import org.opensaml.security.x509.BasicX509Credential; import org.opensaml.security.x509.X509Credential; @@ -92,7 +94,7 @@ private ServiceProviderPrivileges buildPrivileges(SamlServiceProviderDocument.Pr private static URL parseUrl(SamlServiceProviderDocument document) { final URL acs; try { - acs = new URL(document.acs); + acs = Urls.create(document.acs, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS); } catch (MalformedURLException e) { final ServiceProviderException exception = new ServiceProviderException( "Service provider [{}] (doc {}) has an invalid ACS [{}]", diff --git a/x-pack/plugin/ml/qa/native-multi-node-tests/src/javaRestTest/java/org/elasticsearch/xpack/ml/integration/MlNativeIntegTestCase.java b/x-pack/plugin/ml/qa/native-multi-node-tests/src/javaRestTest/java/org/elasticsearch/xpack/ml/integration/MlNativeIntegTestCase.java index 209f12c2e90ce..0e0fdb042e9d3 100644 --- a/x-pack/plugin/ml/qa/native-multi-node-tests/src/javaRestTest/java/org/elasticsearch/xpack/ml/integration/MlNativeIntegTestCase.java +++ b/x-pack/plugin/ml/qa/native-multi-node-tests/src/javaRestTest/java/org/elasticsearch/xpack/ml/integration/MlNativeIntegTestCase.java @@ -6,6 +6,8 @@ */ package org.elasticsearch.xpack.ml.integration; +import io.github.pixee.security.HostValidator; +import io.github.pixee.security.Urls; import org.elasticsearch.action.admin.cluster.snapshots.features.ResetFeatureStateAction; import org.elasticsearch.action.admin.cluster.snapshots.features.ResetFeatureStateRequest; import org.elasticsearch.action.admin.indices.refresh.RefreshAction; @@ -227,7 +229,7 @@ protected TestCluster buildTestCluster(Scope scope, long seed) throws IOExceptio final TransportAddress[] transportAddresses = new TransportAddress[stringAddresses.length]; int i = 0; for (String stringAddress : stringAddresses) { - URL url = new URL("http://" + stringAddress); + URL url = Urls.create("http://" + stringAddress, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS); InetAddress inetAddress = InetAddress.getByName(url.getHost()); transportAddresses[i++] = new TransportAddress(new InetSocketAddress(inetAddress, url.getPort())); }