Package org.elasticsearch.xpack.esql.datasources

Class LocalFileAccess

java.lang.Object

org.elasticsearch.xpack.esql.datasources.LocalFileAccess

public class LocalFileAccess
extends Object

Enforces the esql.datasource.local_allowed_paths allowlist gate for file:// external sources.

An empty allowlist (the default) disables local-disk access entirely — the list is the enable, mirroring path.repo / FsRepository. When non-empty, a file:// path is accepted only if it normalizes to a location under one of the configured roots; ..-escape traversals and paths outside every root are rejected.

Use create(Settings) at node startup. The special singleton UNRESTRICTED bypasses all checks and is intended solely for test-only constructors.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	LOCAL_DISK_DISABLED_MESSAGE	Error shown when a file:// read is attempted but local-disk access is disabled (empty allowlist).
static final LocalFileAccess	UNRESTRICTED	Allow-all sentinel for test-only constructors in StorageProviderRegistry, FileSourceFactory, and DataSourceModule.

Method Summary

Modifier and Type	Method	Description
void	check(String location)	Convenience overload that parses a raw location string and delegates to check(StoragePath).
void	check(StoragePath path)	Validates that the given StoragePath is permitted.
static LocalFileAccess	create(Settings settings)	Builds a LocalFileAccess from the node's startup settings.
boolean	enabled()	Returns true when local-disk reads are permitted (non-empty allowlist).

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

LOCAL_DISK_DISABLED_MESSAGE

public static final String LOCAL_DISK_DISABLED_MESSAGE

Error shown when a file:// read is attempted but local-disk access is disabled (empty allowlist). Shared between the coordinator-side check (FileSourceFactory) and the data-node-side check (StorageProviderRegistry) so both paths report the same message.

See Also:

• Constant Field Values

UNRESTRICTED

public static final LocalFileAccess UNRESTRICTED

Allow-all sentinel for test-only constructors in StorageProviderRegistry, FileSourceFactory, and DataSourceModule. Does not apply path confinement. Never use in production.

Method Details

create

public static LocalFileAccess create(Settings settings)

Builds a LocalFileAccess from the node's startup settings. An empty ExternalSourceSettings.LOCAL_ALLOWED_PATHS list (the default) disables local-disk reads.

enabled

public boolean enabled()

Returns true when local-disk reads are permitted (non-empty allowlist).

check

public void check(StoragePath path)

Validates that the given StoragePath is permitted.

No-op for non-file schemes. For file://:

• If disabled (empty allowlist): throws IllegalArgumentException with LOCAL_DISK_DISABLED_MESSAGE.
• If enabled: resolves the path against the allowed roots via PathUtils.get(Path[], String) (lexical normalize + startsWith — same as FsRepository / Environment.resolveRepoDir). A null result means the path falls outside every allowed root (including ..-escapes); throws with the location appended to PATH_OUTSIDE_ALLOWLIST_PREFIX.

Throws:

IllegalArgumentException - if the path is rejected

check

public void check(String location)

Convenience overload that parses a raw location string and delegates to check(StoragePath). StoragePath extracts the scheme, so any non-file scheme (and any file URI form, including authority-less file:/path) is handled uniformly without relying on a literal prefix match.

Throws:

IllegalArgumentException - if the location is a file:// path that is rejected