Validation of the _source to reject contradicting and ambiguous requests

CHANGELOG.md

@@ -11,6 +11,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Choose the best performing node when writing with append-only index ([#20065](https://github.com/opensearch-project/OpenSearch/pull/20065))
 - Add security policy to allow `accessUnixDomainSocket` in `transport-grpc` module ([#20463](https://github.com/opensearch-project/OpenSearch/pull/20463), [#20649](https://github.com/opensearch-project/OpenSearch/pull/20649))
 - Add range validations in query builder and field mapper ([#20497](https://github.com/opensearch-project/OpenSearch/issues/20497))
+- Add validation of the `_source` object to reject contradicting and ambiguous requests. ([#20612](https://github.com/opensearch-project/OpenSearch/issues/20612))
 - Support TLS cert hot-reload for Arrow Flight transport ([#20700](https://github.com/opensearch-project/OpenSearch/pull/20700))
 - [Workload Management] Enhance Scroll API support for autotagging ([#20151](https://github.com/opensearch-project/OpenSearch/pull/20151))
 - Add indices to search request slowlog ([#20588](https://github.com/opensearch-project/OpenSearch/pull/20588))

modules/transport-grpc/src/test/java/org/opensearch/transport/grpc/proto/request/common/FetchSourceContextProtoUtilsTests.java

@@ -8,6 +8,7 @@
 
 package org.opensearch.transport.grpc.proto.request.common;
 
+import org.opensearch.OpenSearchException;
 import org.opensearch.core.common.Strings;
 import org.opensearch.protobufs.BulkRequest;
 import org.opensearch.protobufs.SearchRequest;
@@ -352,4 +353,23 @@ public void testFromProtoWithSourceConfigFilterBothIncludesAndExcludes() {
         assertArrayEquals("includes should match", new String[] { "include1", "include2" }, context.includes());
         assertArrayEquals("excludes should match", new String[] { "exclude1", "exclude2" }, context.excludes());
     }
+
+    public void testFromProtoWithSourceConfigFilterAmbiguousIncludesAndExcludes() {
+        // Create a SourceConfig with filter includes and excludes
+        final SourceConfig sourceConfig = SourceConfig.newBuilder()
+            .setFilter(
+                SourceFilter.newBuilder()
+                    .addIncludes("theSameEntry")
+                    .addIncludes("include2")
+                    .addExcludes("theSameEntry")
+                    .addExcludes("exclude2")
+                    .build()
+            )
+            .build();
+
+        // Exception when attempting to convert to FetchSourceContext
+        final OpenSearchException e = expectThrows(OpenSearchException.class, () -> FetchSourceContextProtoUtils.fromProto(sourceConfig));
+
+        assertEquals("The same entry [theSameEntry] cannot be both included and excluded in _source.", e.getMessage());
+    }
 }

rest-api-spec/src/main/resources/rest-api-spec/test/search/10_source_filtering.yml

@@ -34,6 +34,64 @@ setup:
   - length:   { hits.hits: 1  }
   - is_false: hits.hits.0._source
 
+---
+"_source as an empty object":
+  - skip:
+      version: " - 3.5.0"
+      reason: "validation was added later"
+  - do:
+      search: { body: { _source: {  }, query: { match_all: {} } } }
+      catch: bad_request
+  - match: { status: 400 }
+  - match: { error.type: parsing_exception }
+  - match: { error.reason: "Expected at least one of [includes] or [excludes]" }
+
+---
+"_source as an empty includes array":
+  - skip:
+      version: " - 3.5.0"
+      reason: "validation was added later"
+  - do:
+      search: { body: { _source: [], query: { match_all: {} } } }
+      catch: bad_request
+  - match: { status: 400 }
+  - match: { error.type: parsing_exception }
+  - match: { error.reason: "Expected at least one value for an array of [includes]" }
+
+---
+"_source with an empty excludes array":
+  - skip:
+      version: " - 3.5.0"
+      reason: "validation was added later"
+  - do:
+      search:
+        body:
+          _source:
+            includes: [ include.field1, include.field2 ]
+            excludes: []
+          query: { match_all: {} }
+      catch: bad_request
+  - match: { status: 400 }
+  - match: { error.type: parsing_exception }
+  - match: { error.reason: "Expected at least one value for an array of [excludes]" }
+
+---
+"_source with an ambiguous field":
+  - skip:
+      version: " - 3.5.0"
+      reason: "validation was added later"
+  - do:
+      search:
+        body:
+          _source:
+            includes: [ include.field1, include.field2 ]
+            excludes: [ include.field1 ]
+          query: { match_all: {} }
+      catch: bad_request
+  - match: { status: 400 }
+  - match: { error.type: parsing_exception }
+  - match: { error.reason: "The same entry [include.field1] cannot be both included and excluded in _source." }
+
 ---
 "no filtering":
   - do: { search: { body: { query: { match_all: {} } } } }