Skip to content

Conversation

@cwperks
Copy link
Member

@cwperks cwperks commented Nov 12, 2025

Description

This PR solves an issue in the RestRequestFilter extension point that is used in cases to mark request params as sensitive so that the request is filtered in cases where the request body may be logged somewhere. Currently, it uses XContentMapValues.filter to perform the filtering, but implementers of this extension point would need to add all permutations of the field in getFilterFields due to the case sensitivity of the filtering.

I propose to make this case insensitive to filter out regardless of the casing.

This is particular useful for endpoints like https://docs.opensearch.org/latest/ml-commons-plugin/remote-models/index/#step-2-create-a-connector

Check List

  • Functionality includes testing.
  • API changes companion pull request created, if applicable.
  • Public documentation issue/PR created, if applicable.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Craig Perkins <cwperx@amazon.com>
@cwperks cwperks requested a review from a team as a code owner November 12, 2025 22:04
Signed-off-by: Craig Perkins <cwperx@amazon.com>
@github-actions
Copy link
Contributor

❌ Gradle check result for 9b955bc: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

Signed-off-by: Craig Perkins <cwperx@amazon.com>
@github-actions
Copy link
Contributor

❌ Gradle check result for 499f406: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

@github-actions
Copy link
Contributor

❌ Gradle check result for 499f406: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

Signed-off-by: Craig Perkins <cwperx@amazon.com>
@andrross
Copy link
Member

I believe the existing filter implementation is used for selecting which fields to return from source, and probably many other user-facing behaviors. I think we'll need to be more surgical about introducing a case-insensitive option and only use it cases that do not change existing semantics.

@github-actions
Copy link
Contributor

❌ Gradle check result for 4efc679: null

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

Copy link
Contributor

@jainankitk jainankitk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am wondering if we should add an option for case insensitive filter instead of changing the default behavior. That should allow addressing the issue for RestRequestFilter extension point in the short term, while keeping the default behavior. Changing default behavior can be separate decision in the longer term

@cwperks
Copy link
Member Author

cwperks commented Nov 14, 2025

Ack, I'll push a commit so that only the path within RestRequestFilter is case insensitive.

@github-actions
Copy link
Contributor

❌ Gradle check result for 9c37810: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

Signed-off-by: Craig Perkins <cwperx@amazon.com>
@github-actions
Copy link
Contributor

❕ Gradle check result for 6fa0c70: UNSTABLE

Please review all flaky tests that succeeded after retry and create an issue if one does not already exist to track the flaky failure.

@codecov
Copy link

codecov bot commented Nov 14, 2025

Codecov Report

❌ Patch coverage is 73.07692% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 73.26%. Comparing base (d5aa830) to head (6fa0c70).
⚠️ Report is 15 commits behind head on main.

Files with missing lines Patch % Lines
...rch/common/xcontent/support/XContentMapValues.java 72.72% 0 Missing and 6 partials ⚠️
...in/java/org/opensearch/rest/RestRequestFilter.java 0.00% 1 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff              @@
##               main   #19976      +/-   ##
============================================
+ Coverage     73.23%   73.26%   +0.02%     
- Complexity    71544    71609      +65     
============================================
  Files          5786     5786              
  Lines        327013   327020       +7     
  Branches      47284    47289       +5     
============================================
+ Hits         239498   239579      +81     
- Misses        68245    68265      +20     
+ Partials      19270    19176      -94     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@cwperks cwperks changed the title Make XContentMapValues.filter case insensitive Add case sensitivity as an argument for XContentMapValues.filter Nov 14, 2025
@cwperks cwperks changed the title Add case sensitivity as an argument for XContentMapValues.filter Add case sensitivity as an argument to XContentMapValues.filter Nov 14, 2025
@cwperks
Copy link
Member Author

cwperks commented Nov 14, 2025

@andrross @jainankitk I pushed a commit to add case sensitivity as a param so it can be used within RestRequestFilter.

Copy link
Contributor

@jainankitk jainankitk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me!

@cwperks cwperks merged commit ab4bd69 into opensearch-project:main Nov 19, 2025
42 of 43 checks passed
@opensearch-trigger-bot
Copy link
Contributor

The backport to 2.19 failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/OpenSearch/backport-2.19 2.19
# Navigate to the new working tree
pushd ../.worktrees/OpenSearch/backport-2.19
# Create a new branch
git switch --create backport/backport-19976-to-2.19
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 ab4bd6937c3866e8e9fedf88479485a2c6e47ca3
# Push it to GitHub
git push --set-upstream origin backport/backport-19976-to-2.19
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/OpenSearch/backport-2.19

Then, create a pull request where the base branch is 2.19 and the compare/head branch is backport/backport-19976-to-2.19.

DarshitChanpura added a commit to DarshitChanpura/security that referenced this pull request Nov 19, 2025
cwperks added a commit that referenced this pull request Nov 19, 2025
…) (#20049)

* Make XContentMapValues.filter case insensitive



* Add to CHANGELOG



* Fix precommit



* Add caseSensitive flag



* Fix tests



---------


(cherry picked from commit ab4bd69)

Signed-off-by: Craig Perkins <cwperx@amazon.com>
rgsriram pushed a commit to rgsriram/OpenSearch that referenced this pull request Dec 5, 2025
…search-project#19976)

* Make XContentMapValues.filter case insensitive

Signed-off-by: Craig Perkins <cwperx@amazon.com>

* Add to CHANGELOG

Signed-off-by: Craig Perkins <cwperx@amazon.com>

* Fix precommit

Signed-off-by: Craig Perkins <cwperx@amazon.com>

* Add caseSensitive flag

Signed-off-by: Craig Perkins <cwperx@amazon.com>

* Fix tests

Signed-off-by: Craig Perkins <cwperx@amazon.com>

---------

Signed-off-by: Craig Perkins <cwperx@amazon.com>
liuguoqingfz pushed a commit to liuguoqingfz/OpenSearch that referenced this pull request Dec 15, 2025
…search-project#19976)

* Make XContentMapValues.filter case insensitive

Signed-off-by: Craig Perkins <cwperx@amazon.com>

* Add to CHANGELOG

Signed-off-by: Craig Perkins <cwperx@amazon.com>

* Fix precommit

Signed-off-by: Craig Perkins <cwperx@amazon.com>

* Add caseSensitive flag

Signed-off-by: Craig Perkins <cwperx@amazon.com>

* Fix tests

Signed-off-by: Craig Perkins <cwperx@amazon.com>

---------

Signed-off-by: Craig Perkins <cwperx@amazon.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport 2.19 backport-failed v3.4.0 Issues and PRs related to version 3.4.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants