Elasticsearch: Whitelist allowed chars in index template creation

[spinscale]

Currently (on 5.5.0) one can create arbitrary index template names, also *.

PUT _template/*
{
  "template": "index*"
}

The problem however is, that by using Regex.simpleMatch when determining template names, we always assume, that * is a regex character and thus the above template can be deleted, but also deletes all other templates.

Might make sense to create a whitelist of allowed characters for index template names, i.e. [a-z0-9-_] or something.

[dakrone]

I think we could just re-use this static method: https://github.com/elastic/elasticsearch/blob/master/core/src/main/java/org/elasticsearch/cluster/metadata/MetaDataCreateIndexService.java#L161-L184

[ismael-hasan]

Would it be possible (and would it make sense) to include a mechanism to delete templates that were already created containing *? Something like a ?useWildcard=false parameter to add to the delete requests

[danielmitterdorfer]

We've discussed this in Fix-It Friday and agree that index, alias and index-template naming rules should be aligned.

We think it does not make sense to complicate the implementation with additional request parameters (like the suggested useWildcard). A workaround to remove such templates is to GET all existing ones, DELETE all of them and create all again with valid names.

[dakrone]

Closing this as we have this validation, it was added in #56170