Skip to content

Use checked exceptions in entitlement constructor rules#145234

Merged
jdconrad merged 12 commits intoelastic:mainfrom
jdconrad:entitlements-constructor-checked-exceptions
Mar 31, 2026
Merged

Use checked exceptions in entitlement constructor rules#145234
jdconrad merged 12 commits intoelastic:mainfrom
jdconrad:entitlements-constructor-checked-exceptions

Conversation

@jdconrad
Copy link
Copy Markdown
Contributor

@jdconrad jdconrad commented Mar 30, 2026

Changes

Constructor entitlement rules updated to throw appropriate checked exceptions instead of NotEntitledException (a RuntimeException). Method references (IOException::new) are used where the exception has a (Throwable) constructor; lambdas with initCause are used where no such constructor exists.

FileInstrumentation

Class Constructor Exception (before) Exception (after)
RandomAccessFile (File, String) NotEntitledException FileNotFoundException
RandomAccessFile (String, String) NotEntitledException FileNotFoundException
FileInputStream (String) NotEntitledException FileNotFoundException
FileInputStream (File) NotEntitledException FileNotFoundException
FileOutputStream (String) NotEntitledException FileNotFoundException
FileOutputStream (String, boolean) NotEntitledException FileNotFoundException
FileOutputStream (File) NotEntitledException FileNotFoundException
FileOutputStream (File, boolean) NotEntitledException FileNotFoundException
FileReader (String) NotEntitledException FileNotFoundException
FileReader (File) NotEntitledException FileNotFoundException
FileReader (File, Charset) NotEntitledException IOException
FileReader (String, Charset) NotEntitledException IOException
FileWriter (String) NotEntitledException IOException
FileWriter (String, boolean) NotEntitledException IOException
FileWriter (File) NotEntitledException IOException
FileWriter (File, Charset) NotEntitledException IOException
FileWriter (File, Charset, boolean) NotEntitledException IOException
FileWriter (File, boolean) NotEntitledException IOException
FileWriter (String, Charset) NotEntitledException IOException
FileWriter (String, Charset, boolean) NotEntitledException IOException
JarFile (String) NotEntitledException IOException
JarFile (File) NotEntitledException IOException
JarFile (String, boolean) NotEntitledException IOException
JarFile (File, boolean) NotEntitledException IOException
JarFile (File, boolean, int) NotEntitledException IOException
JarFile (File, boolean, int, Runtime.Version) NotEntitledException IOException
ZipFile (String) NotEntitledException IOException
ZipFile (File) NotEntitledException IOException
ZipFile (File, int) NotEntitledException IOException
ZipFile (String, Charset) NotEntitledException IOException
ZipFile (File, int, Charset) NotEntitledException IOException
ZipFile (File, Charset) NotEntitledException IOException
PrintWriter (File) NotEntitledException FileNotFoundException
PrintWriter (File, String) NotEntitledException FileNotFoundException
PrintWriter (String) NotEntitledException FileNotFoundException
PrintWriter (String, String) NotEntitledException FileNotFoundException
Scanner (File) NotEntitledException FileNotFoundException
Scanner (File, String) NotEntitledException FileNotFoundException
Scanner (File, Charset) NotEntitledException IOException
FileHandler () NotEntitledException IOException
FileHandler (String) NotEntitledException IOException
FileHandler (String, boolean) NotEntitledException IOException
FileHandler (String, int, int) NotEntitledException IOException
FileHandler (String, int, int, boolean) NotEntitledException IOException
FileHandler (String, long, int, boolean) NotEntitledException IOException

NetworkInstrumentation

Class Constructor Exception (before) Exception (after)
URL (String, String, int, String, URLStreamHandler) NotEntitledException MalformedURLException
URL (URL, String, URLStreamHandler) NotEntitledException MalformedURLException
Socket (String, int) NotEntitledException IOException
Socket (String, int, InetAddress, int) NotEntitledException IOException
Socket (InetAddress, int) NotEntitledException IOException
Socket (InetAddress, int, InetAddress, int) NotEntitledException IOException
Socket (String, int, boolean) NotEntitledException IOException
Socket (InetAddress, int, boolean) NotEntitledException IOException
ServerSocket () NotEntitledException IOException
ServerSocket (int) NotEntitledException IOException
ServerSocket (int, int) NotEntitledException IOException
ServerSocket (int, int, InetAddress) NotEntitledException IOException
DatagramSocket () NotEntitledException SocketException
DatagramSocket (int) NotEntitledException SocketException
DatagramSocket (int, InetAddress) NotEntitledException SocketException
DatagramSocket (SocketAddress) NotEntitledException SocketException

Update constructor entitlement rules in FileInstrumentation and
NetworkInstrumentation to throw appropriate checked exceptions instead
of NotEntitledException (a RuntimeException).

File constructors now throw FileNotFoundException (for constructors
declared to throw it) or IOException (for those with broader checked
exceptions). Network constructors throw IOException for Socket and
ServerSocket, SocketException for DatagramSocket, and
MalformedURLException for URL constructors.

Method references (e.g. IOException::new) are used where the exception
has a (Throwable) constructor; lambdas with initCause are used where no
such constructor exists (FileNotFoundException, MalformedURLException,
SocketException).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jdconrad jdconrad requested a review from a team as a code owner March 30, 2026 19:25
@elasticsearchmachine elasticsearchmachine added v9.4.0 needs:triage Requires assignment of a team area label labels Mar 30, 2026
@jdconrad jdconrad added >refactoring Team:Core/Infra Meta label for core/infra team auto-backport Automatically create backport pull requests when merged :Core/Infra/Entitlements Entitlements infrastructure branch:9.2 branch:8.19 branch:9.3 and removed needs:triage Requires assignment of a team area label labels Mar 30, 2026
@elasticsearchmachine
Copy link
Copy Markdown
Collaborator

Pinging @elastic/es-core-infra (Team:Core/Infra)

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Mar 30, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 09b16c97-de34-474a-98a6-27c79cf3be2e

📥 Commits

Reviewing files that changed from the base of the PR and between 17cacd6 and 9e91033.

📒 Files selected for processing (1)
  • libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/FileCheckActions.java
🚧 Files skipped from review as they are similar to previous changes (1)
  • libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/FileCheckActions.java

📝 Walkthrough

Walkthrough

Updates to entitlement instrumentation in libs/entitlement modify failure handling to throw domain-specific exceptions instead of a generic entitlement denial. FileInstrumentation now maps denied file/stream APIs to either FileNotFoundException or IOException (preserving the original exception as the cause). NetworkInstrumentation maps denied URL construction to MalformedURLException, socket and server socket constructions to IOException, and datagram socket construction to SocketException. Corresponding entitlement tests in FileCheckActions and NetworkAccessCheckActions were updated to expect these specific exception types. No public API signatures were changed.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • 🛠️ Update Documentation: Commit on current branch
  • 🛠️ Update Documentation: Create PR

Comment @coderabbitai help to get the list of available commands and usage tips.

jdconrad and others added 2 commits March 30, 2026 12:41
…ctor rules

Update @EntitlementTest annotations in FileCheckActions and
NetworkAccessCheckActions to set expectedExceptionIfDenied to match the
checked exceptions now thrown by the updated constructor rules:

- FileInputStream, FileOutputStream, RandomAccessFile, FileReader(File/String),
  PrintWriter(File/String), Scanner(File) → FileNotFoundException
- FileReader(File/String+Charset), FileWriter, JarFile, ZipFile,
  Scanner(File+Charset), FileHandler → IOException
- URL(…, URLStreamHandler) → MalformedURLException
- DatagramSocket(SocketAddress) → SocketException

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
libs/entitlement/src/main/java/org/elasticsearch/entitlement/config/NetworkInstrumentation.java (1)

281-298: ⚠️ Potential issue | 🟠 Major

Use initCause() pattern for Java 17 compatibility.

The new SocketException(message, cause) calls on lines 283, 286, 289, 292, and 298 use a constructor available only since Java 19. Since NetworkInstrumentation.java is in the base source set (src/main/java), not a version-specific set, this code runs on Java 17+ and will fail at linkage on Java 17. Replace with the initCause() pattern:

Recommended fix
-            rule.callingStatic(DatagramSocket::new)
-                .enforce(Policies::allNetworkAccess)
-                .elseThrow(e -> new SocketException(e.getMessage(), e));
+            rule.callingStatic(DatagramSocket::new)
+                .enforce(Policies::allNetworkAccess)
+                .elseThrow(e -> {
+                    var ex = new SocketException(e.getMessage());
+                    ex.initCause(e);
+                    return ex;
+                });

Apply the same pattern to all five occurrences of new SocketException(e.getMessage(), e).

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In
`@libs/entitlement/src/main/java/org/elasticsearch/entitlement/config/NetworkInstrumentation.java`
around lines 281 - 298, Replace the Java-19-only SocketException(message, cause)
usages in NetworkInstrumentation with the Java-17-compatible initCause pattern:
for each elseThrow lambda that currently returns new
SocketException(e.getMessage(), e) (e.g., the rules for DatagramSocket
constructors and bind in rule.callingStatic(...), rule.callingVoid(...)), return
a SocketException created with the message and call initCause(e) on it before
returning; do the same for all five occurrences referenced in the DatagramSocket
rules so linkage works on Java 17.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In
`@libs/entitlement/src/main/java/org/elasticsearch/entitlement/config/NetworkInstrumentation.java`:
- Around line 281-298: Replace the Java-19-only SocketException(message, cause)
usages in NetworkInstrumentation with the Java-17-compatible initCause pattern:
for each elseThrow lambda that currently returns new
SocketException(e.getMessage(), e) (e.g., the rules for DatagramSocket
constructors and bind in rule.callingStatic(...), rule.callingVoid(...)), return
a SocketException created with the message and call initCause(e) on it before
returning; do the same for all five occurrences referenced in the DatagramSocket
rules so linkage works on Java 17.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: c3f08f1e-6c43-4cad-8f31-ff5f48961bde

📥 Commits

Reviewing files that changed from the base of the PR and between 78aa896 and 74a0bab.

📒 Files selected for processing (2)
  • libs/entitlement/src/main/java/org/elasticsearch/entitlement/config/FileInstrumentation.java
  • libs/entitlement/src/main/java/org/elasticsearch/entitlement/config/NetworkInstrumentation.java

Copy link
Copy Markdown
Contributor

@mark-vieira mark-vieira left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

jdconrad and others added 5 commits March 30, 2026 13:26
…enied

FileImageInputStream(File) internally calls new RandomAccessFile(File, "r"),
which now throws FileNotFoundException when denied by the entitlement
framework. Update the test annotation accordingly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jdconrad jdconrad merged commit f698e17 into elastic:main Mar 31, 2026
35 checks passed
jdconrad added a commit to jdconrad/elasticsearch that referenced this pull request Mar 31, 2026
Constructor entitlement rules updated to throw appropriate 
checked exceptions instead of NotEntitledException (a 
RuntimeException). Method references (IOException::new) 
are used where the exception has a (Throwable) constructor; 
lambdas with initCause are used where no such constructor 
exists.
jdconrad added a commit to jdconrad/elasticsearch that referenced this pull request Mar 31, 2026
Constructor entitlement rules updated to throw appropriate 
checked exceptions instead of NotEntitledException (a 
RuntimeException). Method references (IOException::new) 
are used where the exception has a (Throwable) constructor; 
lambdas with initCause are used where no such constructor 
exists.
jdconrad added a commit to jdconrad/elasticsearch that referenced this pull request Mar 31, 2026
Constructor entitlement rules updated to throw appropriate 
checked exceptions instead of NotEntitledException (a 
RuntimeException). Method references (IOException::new) 
are used where the exception has a (Throwable) constructor; 
lambdas with initCause are used where no such constructor 
exists.
@elasticsearchmachine
Copy link
Copy Markdown
Collaborator

💚 Backport successful

Status Branch Result
9.3
8.19
9.2

szybia added a commit to szybia/elasticsearch that referenced this pull request Mar 31, 2026
…rics

* upstream/main: (21 commits)
  Mute org.elasticsearch.xpack.esql.qa.mixed.MixedClusterEsqlSpecIT test {csv-spec:external-basic.topSnippetsFunction} elastic#145353
  Mute org.elasticsearch.xpack.esql.qa.mixed.MixedClusterEsqlSpecIT test {csv-spec:external-basic.scoreFunction} elastic#145352
  [DiskBBQ] Fix bug in NeighborQueue#popRawAndAddRaw (elastic#145324)
  Fix dense_vector default index options when using BFLOAT16 (elastic#145202)
  Use checked exceptions in entitlement constructor rules (elastic#145234)
  ESQL: DS: datasource file plugins should not return TEXT types (elastic#145334)
  Plumb DLM error store through to DlmFrozenTransition classes (elastic#145243)
  Make Settings.Builder.remove() fluent (elastic#145294)
  Add FLS tests for METRICS_INFO and TS_INFO (elastic#145211)
  Fix flaky SecurityFeatureResetTests (elastic#145063)
  [DOCS] Fix conflict markers in ESQL processing command list (elastic#145338)
  Skip certain metric assertions on Windows (elastic#144933)
  [ES|QL] Add schema reconciliation for multi-file external sources (elastic#145220)
  Simplify DiskBBQ dynamic visit ratio to linear (elastic#142784)
  ESQL: Disallow unmapped_fields=load with partial non-KEYWORD (elastic#144109)
  [Transform] Track Linked Projects (elastic#144399)
  Fix bulk scoring to process last batch instead of falling through to scalar tail (elastic#145316)
  Clean up TickerScheduleEngineTests (elastic#145303)
  [CI] ShardBulkInferenceActionFilterIT testRestart - Ensuring that secrets-inference index is available after full restart and unmuting test (elastic#145317)
  Add CRUD doc to the DistributedArchitectureGuide (elastic#144710)
  ...
elasticsearchmachine pushed a commit that referenced this pull request Mar 31, 2026
…45349)

Constructor entitlement rules updated to throw appropriate 
checked exceptions instead of NotEntitledException (a 
RuntimeException). Method references (IOException::new) 
are used where the exception has a (Throwable) constructor; 
lambdas with initCause are used where no such constructor 
exists.
elasticsearchmachine pushed a commit that referenced this pull request Mar 31, 2026
…45351)

Constructor entitlement rules updated to throw appropriate 
checked exceptions instead of NotEntitledException (a 
RuntimeException). Method references (IOException::new) 
are used where the exception has a (Throwable) constructor; 
lambdas with initCause are used where no such constructor 
exists.
elasticsearchmachine pushed a commit that referenced this pull request Mar 31, 2026
…) (#145350)

* Use checked exceptions in entitlement constructor rules (#145234)

Constructor entitlement rules updated to throw appropriate 
checked exceptions instead of NotEntitledException (a 
RuntimeException). Method references (IOException::new) 
are used where the exception has a (Throwable) constructor; 
lambdas with initCause are used where no such constructor 
exists.

* Fix SocketException construction to use initCause for Java 11 compatibility

SocketException(String, Throwable) was added in Java 16. Replace the
two-arg constructor with the initCause pattern so the code compiles on
Java 11 (used by the 8.x branches).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
ncordon pushed a commit to ncordon/elasticsearch that referenced this pull request Apr 1, 2026
Constructor entitlement rules updated to throw appropriate 
checked exceptions instead of NotEntitledException (a 
RuntimeException). Method references (IOException::new) 
are used where the exception has a (Throwable) constructor; 
lambdas with initCause are used where no such constructor 
exists.
mromaios pushed a commit to mromaios/elasticsearch that referenced this pull request Apr 9, 2026
Constructor entitlement rules updated to throw appropriate 
checked exceptions instead of NotEntitledException (a 
RuntimeException). Method references (IOException::new) 
are used where the exception has a (Throwable) constructor; 
lambdas with initCause are used where no such constructor 
exists.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

auto-backport Automatically create backport pull requests when merged :Core/Infra/Entitlements Entitlements infrastructure >refactoring Team:Core/Infra Meta label for core/infra team v8.19.14 v9.2.8 v9.3.3 v9.4.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants