Adds check for negative search request size #25397

colings86 · 2017-06-26T11:45:13Z

This change adds a check to SearchSourceBuilder to throw and exception if the size set on it is set to a negative value.

Closes #22530

cbuescher

@colings86 thanks, this change makes a lot of sence. I left two smallish suggestions, but my main concern merging this to 5.x without marking it as breaking. Currently users who use "size" : -1 in their code will get the default of 10 hits, with this change we would error both on REST and on Java API layer.
I think this is sufficient to only merge this change to master and I would suggest adding some notes about this in the changes/migration docs or anywhere else that might be appropriate. If we need this on 5.x as well I'd ask to include -1 as valid argument for bwc that then default to 10 hits.

cbuescher · 2017-06-26T13:19:02Z

core/src/main/java/org/elasticsearch/search/builder/SearchSourceBuilder.java

@@ -344,6 +344,9 @@ public int from() {
     * The number of search hits to return. Defaults to <tt>10</tt>.
     */
    public SearchSourceBuilder size(int size) {
+        if (size < 0) {
+            throw new IllegalArgumentException("[size] parameter cannot be negative");
+        }


Maybe we can set the size to the default of 10, that's what SearchService#createContext defaults to later on anyway if it finds the current -1 value. I just find it easier to reason about if the value is set to the default in this case.

I think it's best to keep the default as-is here and let it be handled when creating the context as today so that we can distinguish between set and set from default.

Okay, the set/unset distinction makes sense e.g. when using the builder on the client side, otherwise we would always render the size even if not set. What makes me not like this is the fact that we reject "-1" as illegal but still use it as a "legal" value meaning something internally. To me it feels a bit weird when you are just looking at this class.

cbuescher · 2017-06-26T13:19:07Z

core/src/test/java/org/elasticsearch/search/builder/SearchSourceBuilderTests.java

@@ -365,6 +365,13 @@ public void testNegativeFromErrors() {
        assertEquals("[from] parameter cannot be negative", expected.getMessage());
    }

+    public void testNegativeSizeErrors() {
+        IllegalArgumentException expected = expectThrows(IllegalArgumentException.class, () -> new SearchSourceBuilder().size(-2));


nit: maybe you could test -1 and another random negative int instead?

jasontedor · 2017-06-26T13:44:48Z

I think it's okay to make the change in 5.x, using -1 as the default is completely undocumented.

jasontedor

I left one suggestion.

jasontedor · 2017-06-26T13:47:05Z

core/src/main/java/org/elasticsearch/search/builder/SearchSourceBuilder.java

@@ -344,6 +344,9 @@ public int from() {
     * The number of search hits to return. Defaults to <tt>10</tt>.
     */
    public SearchSourceBuilder size(int size) {
+        if (size < 0) {
+            throw new IllegalArgumentException("[size] parameter cannot be negative");


Maybe include the illegal value?

colings86 · 2017-06-26T13:53:11Z

@jasontedor @cbuescher thanks for the reviews, the change has a few implications for reindex which I am in the process of resolving so I may ping you for review again after thats done

cbuescher · 2017-06-26T13:57:17Z

using -1 as the default is completely undocumented

Nevertheless it will break your application if you currently use -1 for whatever reason. I'm not against changes like this, but I wonder if it is necessary to do this on a 5 version.

This change adds a check to `SearchSourceBuilder` to throw and exception if the size set on it is set to a negative value. Closes #22530

colings86 · 2017-07-03T12:41:03Z

@cbuescher @jasontedor @nik9000 I pushed an update to this to address the problems from re-index. #24344 will also help this since it will decouple re-index's size from the search request's size

nik9000 · 2017-07-03T13:12:28Z

...es/reindex/src/main/java/org/elasticsearch/index/reindex/AbstractBulkByQueryRestHandler.java

@@ -52,7 +50,7 @@ protected void parseInternalRequest(Request internal, RestRequest restRequest,

        SearchRequest searchRequest = internal.getSearchRequest();
        int scrollSize = searchRequest.source().size();
-        searchRequest.source().size(SIZE_ALL_MATCHES);
+        // searchRequest.source().size(SIZE_ALL_MATCHES);


I think you should just remove this line entirely.

Well spotted, I had meant to remove this

cbuescher · 2017-07-03T13:32:13Z

LGTM, left one smallish test suggestion above from the first review round that hasn't been adressed, but I'm good either way.

* master: [Analysis] Support normalizer in request param (elastic#24767) Remove deprecated IdsQueryBuilder constructor (elastic#25529) Adds check for negative search request size (elastic#25397) test: also inspect the upgrade api response to check whether the upgrade really ran [DOCS] restructure java clients docs pages (elastic#25517)

colings86 added :Search/Search Search-related issues that do not fall into other categories >bug review v5.5.0 v5.6.0 v6.0.0 labels Jun 26, 2017

colings86 self-assigned this Jun 26, 2017

colings86 requested a review from cbuescher June 26, 2017 11:45

cbuescher requested changes Jun 26, 2017

View reviewed changes

jasontedor approved these changes Jun 26, 2017

View reviewed changes

clintongormley added v5.5.1 and removed v5.5.0 labels Jun 29, 2017

colings86 added 3 commits July 3, 2017 12:04

Adds check for negative search request size

ac3e6d9

This change adds a check to `SearchSourceBuilder` to throw and exception if the size set on it is set to a negative value. Closes #22530

fix error in reindex

b2386c6

update re-index tests

eaf6265

colings86 requested a review from nik9000 July 3, 2017 12:41

nik9000 approved these changes Jul 3, 2017

View reviewed changes

colings86 added 2 commits July 3, 2017 14:14

Addresses review comment

6821a09

Fixed tests

4af6263

cbuescher approved these changes Jul 3, 2017

View reviewed changes

Added random negative size test

75b3183

colings86 removed v5.5.1 v5.6.0 labels Jul 3, 2017

Fixes test

e464e56

colings86 merged commit 43efcff into elastic:master Jul 4, 2017

colings86 deleted the fix/22530 branch July 4, 2017 09:51

colings86 added v6.0.0-beta1 and removed v6.0.0 labels Aug 3, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adds check for negative search request size #25397

Adds check for negative search request size #25397

colings86 commented Jun 26, 2017

cbuescher left a comment

cbuescher Jun 26, 2017

jasontedor Jun 26, 2017

cbuescher Jun 26, 2017

cbuescher Jun 26, 2017

jasontedor commented Jun 26, 2017

jasontedor left a comment

jasontedor Jun 26, 2017

colings86 commented Jun 26, 2017

cbuescher commented Jun 26, 2017

colings86 commented Jul 3, 2017

nik9000 Jul 3, 2017

colings86 Jul 3, 2017

cbuescher commented Jul 3, 2017

Adds check for negative search request size #25397

Adds check for negative search request size #25397

Conversation

colings86 commented Jun 26, 2017

cbuescher left a comment

Choose a reason for hiding this comment

cbuescher Jun 26, 2017

Choose a reason for hiding this comment

jasontedor Jun 26, 2017

Choose a reason for hiding this comment

cbuescher Jun 26, 2017

Choose a reason for hiding this comment

cbuescher Jun 26, 2017

Choose a reason for hiding this comment

jasontedor commented Jun 26, 2017

jasontedor left a comment

Choose a reason for hiding this comment

jasontedor Jun 26, 2017

Choose a reason for hiding this comment

colings86 commented Jun 26, 2017

cbuescher commented Jun 26, 2017

colings86 commented Jul 3, 2017

nik9000 Jul 3, 2017

Choose a reason for hiding this comment

colings86 Jul 3, 2017

Choose a reason for hiding this comment

cbuescher commented Jul 3, 2017