DLS/FLS fixes

Signed-off-by: Nils Bandener <[email protected]>
opensearch-project · Sep 16, 2024 · d8aa346 · d8aa346
1 parent bdfe2b5
commit d8aa346
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/src/main/java/org/opensearch/security/configuration/DlsFlsValveImpl.java b/src/main/java/org/opensearch/security/configuration/DlsFlsValveImpl.java
@@ -487,7 +487,7 @@ public boolean hasFieldMasking(String index) throws PrivilegesEvaluationExceptio
     public boolean isFieldAllowed(String index, String field) throws PrivilegesEvaluationException {
         PrivilegesEvaluationContext privilegesEvaluationContext = this.dlsFlsBaseContext.getPrivilegesEvaluationContext();
         if (privilegesEvaluationContext == null) {
-            return false;
+            return true;
         }
 
         DlsFlsProcessedConfig config = this.dlsFlsProcessedConfig.get();

diff --git a/src/main/java/org/opensearch/security/privileges/dlsfls/DocumentPrivileges.java b/src/main/java/org/opensearch/security/privileges/dlsfls/DocumentPrivileges.java
@@ -15,6 +15,7 @@
 import java.util.List;
 import java.util.Map;
 
+import org.apache.logging.log4j.util.Strings;
 import org.opensearch.cluster.metadata.IndexAbstraction;
 import org.opensearch.common.settings.Settings;
 import org.opensearch.common.xcontent.json.JsonXContent;
@@ -57,7 +58,7 @@ static DlsQuery roleToRule(RoleV7.Index rolePermissions, NamedXContentRegistry x
         throws PrivilegesConfigurationValidationException {
         String dlsQueryTemplate = rolePermissions.getDls();
 
-        if (dlsQueryTemplate != null) {
+        if (dlsQueryTemplate != null && !Strings.isBlank(dlsQueryTemplate)) {
             return DlsQuery.create(dlsQueryTemplate, xContentRegistry);
         } else {
             return null;