[Corner case] Script working event after disabling dynamic scripting

[Vineeth-Mohan]

On executing

{
  "size": 0,
  "aggs": {
    "sum": {
      "sum": {
        "script": "doc.score"
      }
    }
  }
}

I am seeing
{
took: 13
timed_out: false
_shards: {
total: 1
successful: 1
failed: 0
}
hits: {
total: 1946
max_score: 0
hits: [ ]
}
aggregations: {
sum: {
value: 1946
}
}
}

But on executing

{
  "size": 0,
  "aggs": {
    "sum": {
      "sum": {
        "script": "_score"
      }
    }
  }
}

I am getting - SearchPhaseExecutionException[Failed to execute phase [query_fetch], all shards failed; shardFailures {[OtHPQX2iRj2yhtfeBMqJgA][restaurants][0]: SearchParseException[[restaurants][0]: from[-1],size[0]: Parse Failure [Failed to parse source [{"size":0,"aggs":{"sum":{"sum":{"script":"_score"}}}}]]]; nested: ScriptException[dynamic scripting for [mvel] disabled]; }]

[clintongormley]

Hi @Vineeth-Mohan

I'm unable to replicate this on 1.3.2. Could you provide a complete standalone replication?

thanks

[Vineeth-Mohan]

@clintongormley - My apologies , it was not _size , it was doc.score.
My concern was that , with scripting disabled , doc.score is working , but _score is giving "scripting disabled error".

[clintongormley]

True, in 1.3.3, with scripting disabled:

This works:

"doc.score"

While this returns an error about disabled scripting:

"doc.score+1"

@brwe any ideas here?

[brwe]

doc.score is pre compiled always for optimization: https://github.com/elasticsearch/elasticsearch/blob/1.3/src/main/java/org/elasticsearch/script/ScriptService.java#L250 so the dynamic script check is not performed.
This is already removed in >=1.4, see #7819
It is confusing but I am unsure if it makes sense to remove it. I can do it if you think so.

[clintongormley]

@brwe no, it's not a security issue. i'd leave it as it is, esp as it is already fixed in 1.4.

thanks for looking