[ES|QL] Validate index name in parser

docs/changelog/112081.yaml

@@ -0,0 +1,5 @@
+pr: 112081
+summary: "[ES|QL] Validate index name in parser"
+area: ES|QL
+type: enhancement
+issues: []

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/parser/IdentifierBuilder.java

@@ -8,14 +8,19 @@
 package org.elasticsearch.xpack.esql.parser;
 
 import org.antlr.v4.runtime.tree.TerminalNode;
+import org.elasticsearch.ElasticsearchParseException;
+import org.elasticsearch.cluster.metadata.IndexNameExpressionResolver;
+import org.elasticsearch.cluster.metadata.MetadataCreateIndexService;
 import org.elasticsearch.common.Strings;
+import org.elasticsearch.indices.InvalidIndexNameException;
 import org.elasticsearch.xpack.esql.parser.EsqlBaseParser.IdentifierContext;
 import org.elasticsearch.xpack.esql.parser.EsqlBaseParser.IndexStringContext;
 
 import java.util.ArrayList;
 import java.util.List;
 
 import static org.elasticsearch.transport.RemoteClusterAware.REMOTE_CLUSTER_INDEX_SEPARATOR;
+import static org.elasticsearch.xpack.esql.parser.ParserUtils.source;
 
 abstract class IdentifierBuilder extends AbstractBuilder {
 
@@ -48,10 +53,32 @@ public String visitIndexPattern(List<EsqlBaseParser.IndexPatternContext> ctx) {
         List<String> patterns = new ArrayList<>(ctx.size());
         ctx.forEach(c -> {
             String indexPattern = visitIndexString(c.indexString());
+            validateIndexPattern(indexPattern, c);
             patterns.add(
                 c.clusterString() != null ? c.clusterString().getText() + REMOTE_CLUSTER_INDEX_SEPARATOR + indexPattern : indexPattern
             );
         });
         return Strings.collectionToDelimitedString(patterns, ",");
     }
+
+    private static void validateIndexPattern(String indexPattern, EsqlBaseParser.IndexPatternContext ctx) {
+        String[] indices = indexPattern.replace("*", "").split(",");
+        try {
+            for (String index : indices) {
+                if (index.isBlank()) {
+                    continue;
+                }
+                index = removeExclusion(index.strip());
+                String temp = IndexNameExpressionResolver.resolveDateMathExpression(index);
+                index = temp.equals(index) ? index : removeExclusion(temp);
+                MetadataCreateIndexService.validateIndexOrAliasName(index, InvalidIndexNameException::new);
+            }
+        } catch (InvalidIndexNameException | ElasticsearchParseException e) {
+            throw new ParsingException(e, source(ctx), e.getMessage());
+        }
+    }
+
+    private static String removeExclusion(String indexPattern) {
+        return indexPattern.charAt(0) == '-' ? indexPattern.substring(1) : indexPattern;
+    }
 }

x-pack/plugin/esql/src/test/java/org/elasticsearch/xpack/esql/parser/AbstractStatementParserTests.java

@@ -7,6 +7,7 @@
 
 package org.elasticsearch.xpack.esql.parser;
 
+import org.elasticsearch.common.logging.LoggerMessageFormat;
 import org.elasticsearch.test.ESTestCase;
 import org.elasticsearch.xpack.esql.VerificationException;
 import org.elasticsearch.xpack.esql.core.expression.Literal;
@@ -124,4 +125,8 @@ void expectError(String query, List<QueryParam> params, String errorMessage) {
         );
         assertThat(e.getMessage(), containsString(errorMessage));
     }
+
+    void expectError(String query, String arg, String errorMessage) {
+        expectError(LoggerMessageFormat.format(null, query, arg), errorMessage);
+    }
 }

x-pack/plugin/esql/src/test/java/org/elasticsearch/xpack/esql/parser/StatementParserTests.java

@@ -367,24 +367,16 @@ public void testStringAsIndexPattern() {
                 "<logstash-{now/M{yyyy.MM}}>,<logstash-{now/d{yyyy.MM.dd|+12:00}}>",
                 command + " <logstash-{now/M{yyyy.MM}}>, \"<logstash-{now/d{yyyy.MM.dd|+12:00}}>\""
             );
-
             assertStringAsIndexPattern("foo,test,xyz", command + " \"\"\"foo\"\"\",   test,\"xyz\"");
-
             assertStringAsIndexPattern("`backtick`,``multiple`back``ticks```", command + " `backtick`, ``multiple`back``ticks```");
-
             assertStringAsIndexPattern("test,metadata,metaata,.metadata", command + " test,\"metadata\", metaata, .metadata");
-
             assertStringAsIndexPattern(".dot", command + " .dot");
-
             assertStringAsIndexPattern("cluster:index", command + " cluster:index");
-            assertStringAsIndexPattern("cluster:index|pattern", command + " cluster:\"index|pattern\"");
             assertStringAsIndexPattern("cluster:.index", command + " cluster:.index");
             assertStringAsIndexPattern("cluster*:index*", command + " cluster*:index*");
             assertStringAsIndexPattern("cluster*:*", command + " cluster*:*");
             assertStringAsIndexPattern("*:index*", command + " *:index*");
-            assertStringAsIndexPattern("*:index|pattern", command + " *:\"index|pattern\"");
             assertStringAsIndexPattern("*:*", command + " *:*");
-            assertStringAsIndexPattern("*:*,cluster*:index|pattern,i|p", command + " *:*, cluster*:\"index|pattern\", \"i|p\"");
         }
     }
 
@@ -405,19 +397,45 @@ public void testStringAsLookupIndexPattern() {
         );
 
         assertStringAsLookupIndexPattern("foo", "ROW x = 1 | LOOKUP \"\"\"foo\"\"\" ON j");
-
         assertStringAsLookupIndexPattern("`backtick`", "ROW x = 1 | LOOKUP `backtick` ON j");
         assertStringAsLookupIndexPattern("``multiple`back``ticks```", "ROW x = 1 | LOOKUP ``multiple`back``ticks``` ON j");
-
         assertStringAsLookupIndexPattern(".dot", "ROW x = 1 | LOOKUP .dot ON j");
-
         assertStringAsLookupIndexPattern("cluster:index", "ROW x = 1 | LOOKUP cluster:index ON j");
         assertStringAsLookupIndexPattern("cluster:.index", "ROW x = 1 | LOOKUP cluster:.index ON j");
         assertStringAsLookupIndexPattern("cluster*:index*", "ROW x = 1 | LOOKUP cluster*:index* ON j");
         assertStringAsLookupIndexPattern("cluster*:*", "ROW x = 1 | LOOKUP cluster*:* ON j");
         assertStringAsLookupIndexPattern("*:index*", "ROW x = 1 | LOOKUP  *:index* ON j");
         assertStringAsLookupIndexPattern("*:*", "ROW x = 1 | LOOKUP  *:* ON j");
+    }
 
+    public void testInvalidCharacterInIndexPattern() {
+        for (String command : List.of("FROM {}", "METRICS {}", "ROW x = 1 | LOOKUP {} ON j")) {
+            expectError(command, " cluster:\"index|pattern\"", "Invalid index name [index|pattern]");
+            expectError(command, " *:\"index|pattern\"", "Invalid index name [index|pattern]");
+            expectError(command, " cluster:\"index#pattern\"", "Invalid index name [index#pattern]");
+            expectError(command, " cluster:index#pattern", "Invalid index name [index#pattern]");
+            expectError(command, " cluster:\"index pattern\"", "Invalid index name [index pattern]");
+            expectError(command, " cluster:\"index?pattern\"", "Invalid index name [index?pattern]");
+            expectError(command, " cluster:index?pattern", "Invalid index name [index?pattern]");
+            expectError(command, " cluster:\"index>pattern\"", "Invalid index name [index>pattern]");
+            expectError(command, " cluster:index>pattern", "Invalid index name [index>pattern]");
+            expectError(command, " cluster:\"index<pattern\"", "Invalid index name [index<pattern]");
+            expectError(command, " cluster:index<pattern", "Invalid index name [index<pattern]");
+            expectError(command, " cluster:\"index/pattern\"", "Invalid index name [index/pattern]");
+            expectError(command, " cluster:index/pattern", "Invalid index name [index/pattern]");
+            expectError(command, " cluster:\"index\\\\pattern\"", "Invalid index name [index\\pattern]");
+            expectError(command, " cluster:index\\pattern", "Invalid index name [index\\pattern]");
+            expectError(command, " cluster:\"..\"", "Invalid index name [..]");
+            expectError(command, " cluster:..", "Invalid index name [..]");
+            expectError(command, " cluster:\"_indexpattern\"", "Invalid index name [_indexpattern]");
+            expectError(command, " cluster:_indexpattern", "Invalid index name [_indexpattern]");
+            expectError(command, " cluster:\"+indexpattern\"", "Invalid index name [+indexpattern]");
+            expectError(command, " cluster:+indexpattern", "Invalid index name [+indexpattern]");
+            expectError(command, " cluster:\"--indexpattern\"", "Invalid index name [-indexpattern]");
+            expectError(command, " cluster:--indexpattern", "Invalid index name [-indexpattern]");
+            expectError(command, " cluster:\"<--logstash-{now/M{yyyy.MM}}>\"", "Invalid index name [-logstash-");
+            expectError(command, "  --<logstash-{now/M{yyyy.MM}}>", "Invalid index name [-<logstash-{now/M{yyyy.MM}}>]");
+        }
     }
 
     public void testInvalidQuotingAsFromIndexPattern() {
@@ -1551,7 +1569,7 @@ public void testMetricsIdentifiers() {
             Map.entry("metrics foo,test-*", "foo,test-*"),
             Map.entry("metrics 123-test@foo_bar+baz1", "123-test@foo_bar+baz1"),
             Map.entry("metrics foo,   test,xyz", "foo,test,xyz"),
-            Map.entry("metrics <logstash-{now/M{yyyy.MM}}>>", "<logstash-{now/M{yyyy.MM}}>>")
+            Map.entry("metrics <logstash-{now/M{yyyy.MM}}>", "<logstash-{now/M{yyyy.MM}}>")
         );
         for (Map.Entry<String, String> e : patterns.entrySet()) {
             assertStatement(e.getKey(), unresolvedRelation(e.getValue()));