Stored scripts API accepting malformed requests

[clintongormley]

The stored scripts API today accepts malformed requests instead of throwing an exception. For instance:

POST _scripts/foo
{
  "source": "return"
}

GET _scripts/foo

returns

{
  "_id": "foo",
  "found": true,
  "script": {
    "lang": "mustache",
    "source": """{"source":"return"}"""
  }
}

[rjernst]

You need to tell it to compile against a script context. Pass the context parameter (url) to the put stored script api with a context name, eg template if you are using a mustache script.

[clintongormley]

The documentation for this API doesn't mention contexts, so I can't figure out exactly how this is supposed to be used, but it seems like my original example above should throw an exception, no?

[rjernst]

No, your example does not compile the script, it only stores it. We discussed making context required in previous issues before adding script contexts, but you thought that was too cumbersome for users. :) . It sounds like we just need to update the documentation.

[rjernst]

My apologies, I misread the issue here. The problem is due to having support for old templates. This was where the entire template was passed. Essentially there is a heuristic that looks for "template", looks for "script", and if it doesn't find those, then it takes the entire body as the script source.

[topalavlad]

Hi all, I'd like to start tinkering with the code and this seemed like a good issue to start with, but to me it seems this loose script definition might have been intended.

As @rjernst said, if "script" and "template" are not found, an object with the provided JSON contents is created in
StoredScriptSource#parse(BytesReference content, XContentType xContentType) so I'm not sure what the desired fix is.

Do you think the object should be restricted to a more specific template? If not, should this issue be closed?

[rjernst]

@topalavlad The fix here is to deprecate/remove support for this leniency. It was my original intention to remove this for 6.0, but i did not get to deprecating it in time in 5.x. Additionally, "template" should also be deprecated/removed, but that is a separate issue (and possibly a bit more involved, I don't remember all the details from the last time I looked).

[topalavlad]

Cool, I'll try to remove the part which accepts anything and see which tests will fail

[golankopi]

Hi, any updates on that issue?

In addition to much mentioned here, any script created will be stored successfully:

POST _scripts/foo
{
      "script": {
        "source": "fsafsfsfsfsafasf",
        "lang": "painless"
    }
}

will return:

{
  "acknowledged": true
}

and GET _scripts/foo
will return:

{
  "_id": "foo",
  "found": true,
  "script": {
    "lang": "painless",
    "source": "fsafsfsfsfsafasf"
  }
}