{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/elasticsearch/issues/15062","labels_url":"https://api.github.com/repos/elastic/elasticsearch/issues/15062/labels{/name}","comments_url":"https://api.github.com/repos/elastic/elasticsearch/issues/15062/comments","events_url":"https://api.github.com/repos/elastic/elasticsearch/issues/15062/events","html_url":"https://github.com/elastic/elasticsearch/issues/15062","id":119182663,"number":15062,"title":"Plugin policy not being applied on Windows","user":{"login":"costin","id":76245,"avatar_url":"https://avatars.githubusercontent.com/u/76245?v=3","gravatar_id":"","url":"https://api.github.com/users/costin","html_url":"https://github.com/costin","followers_url":"https://api.github.com/users/costin/followers","following_url":"https://api.github.com/users/costin/following{/other_user}","gists_url":"https://api.github.com/users/costin/gists{/gist_id}","starred_url":"https://api.github.com/users/costin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/costin/subscriptions","organizations_url":"https://api.github.com/users/costin/orgs","repos_url":"https://api.github.com/users/costin/repos","events_url":"https://api.github.com/users/costin/events{/privacy}","received_events_url":"https://api.github.com/users/costin/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/elastic/elasticsearch/labels/:Plugins","name":":Plugins","color":"009800"},{"url":"https://api.github.com/repos/elastic/elasticsearch/labels/v2.2.0","name":"v2.2.0","color":"dddddd"},{"url":"https://api.github.com/repos/elastic/elasticsearch/labels/v3.0.0","name":"v3.0.0","color":"dddddd"}],"state":"open","locked":false,"assignee":{"login":"rmuir","id":504194,"avatar_url":"https://avatars.githubusercontent.com/u/504194?v=3","gravatar_id":"","url":"https://api.github.com/users/rmuir","html_url":"https://github.com/rmuir","followers_url":"https://api.github.com/users/rmuir/followers","following_url":"https://api.github.com/users/rmuir/following{/other_user}","gists_url":"https://api.github.com/users/rmuir/gists{/gist_id}","starred_url":"https://api.github.com/users/rmuir/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rmuir/subscriptions","organizations_url":"https://api.github.com/users/rmuir/orgs","repos_url":"https://api.github.com/users/rmuir/repos","events_url":"https://api.github.com/users/rmuir/events{/privacy}","received_events_url":"https://api.github.com/users/rmuir/received_events","type":"User","site_admin":false},"milestone":null,"comments":1,"created_at":"2015-11-27T11:42:48Z","updated_at":"2015-11-27T13:59:25Z","closed_at":null,"body":"Due to a particularity in dealing with drive letters, the security policy files for plugins are read but never matched on Windows.\r\n\r\nAfter much hairy pulling, the issue was discovered to be caused in `Security.java#getPluginPermissions()` in particular\r\n`codebases.add(jar.toRealPath().toUri().toURL());`\r\n\r\nFor the given `Path` which points to `e:\\tmp\\repository-hdfs\\elasticsearch-3.0.0-SNAPSHOT\\plugins\\lang-groovy\\groovy-all-2.4.4-indy.jar`, we get the following behaviour:\r\n\r\n`jar.toAbsolutePath()` -> `e:\\tmp\\repository-hdfs\\elasticsearch-3.0.0-SNAPSHOT\\plugins\\lang-groovy\\groovy-all-2.4.4-indy.jar`\r\n\r\n`jar.toRealPath()` -> `E:\\tmp\\repository-hdfs\\elasticsearch-3.0.0-SNAPSHOT\\plugins\\lang-groovy\\groovy-all-2.4.4-indy.jar`\r\n\r\nThus the policy is keyed under a upper case `E` but the `ProtectionDomain`/`CodeBase` is using the lower case version:\r\n\r\n```\r\naccess: domain that failed ProtectionDomain  (file:/e:/tmp/repository-hdfs/elasticsearch-3.0.0-SNAPSHOT/plugins/lang-groovy/groovy-all-2.4.4-indy.jar <no signer certificates>)\r\n java.net.FactoryURLClassLoader@52af26ee\r\n <no principals>\r\n java.security.Permissions@7d30007d (\r\n (\"java.io.FilePermission\" \"\\e:\\tmp\\repository-hdfs\\elasticsearch-3.0.0-SNAPSHOT\\plugins\\lang-groovy\\groovy-all-2.4.4-indy.jar\" \"read\")\r\n)\r\n```\r\n\r\nUnfortunately the `URLClassLoader` relies on sun specific classes in retrieving the URL but it looks like it does not rely on the `java.nio` package. Potential solutions would be using `absolutePath` instead though that does not handle symlinks or adding a special check for Windows (which likely might actually work only on Oracle/Sun JDK as it is platform and implementation specific) that lowercases the drive letter.\r\nI wonder who this behaves with things like SMB or other crazy URLs.\r\n"},"comment":{"url":"https://api.github.com/repos/elastic/elasticsearch/issues/comments/160145352","html_url":"https://github.com/elastic/elasticsearch/issues/15062#issuecomment-160145352","issue_url":"https://api.github.com/repos/elastic/elasticsearch/issues/15062","id":160145352,"user":{"login":"rmuir","id":504194,"avatar_url":"https://avatars.githubusercontent.com/u/504194?v=3","gravatar_id":"","url":"https://api.github.com/users/rmuir","html_url":"https://github.com/rmuir","followers_url":"https://api.github.com/users/rmuir/followers","following_url":"https://api.github.com/users/rmuir/following{/other_user}","gists_url":"https://api.github.com/users/rmuir/gists{/gist_id}","starred_url":"https://api.github.com/users/rmuir/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rmuir/subscriptions","organizations_url":"https://api.github.com/users/rmuir/orgs","repos_url":"https://api.github.com/users/rmuir/repos","events_url":"https://api.github.com/users/rmuir/events{/privacy}","received_events_url":"https://api.github.com/users/rmuir/received_events","type":"User","site_admin":false},"created_at":"2015-11-27T13:59:25Z","updated_at":"2015-11-27T13:59:25Z","body":"Thanks Costin. Unfortunately we need symlink resolution... We got eg jenkins boxes with linked .m2. And despite the trouble i think simple string lookup is important. My current thinking is .toFile then getCanonical... But i have not looked yet."}}