I'm building an Elasticsearch query using QueryBuilders
in my backend. The cluster is not directly exposed to the internet, and only accessed through the backend.
I've noticed that I am providing it with un-santized user input, and it reminded me of SQL injections. I know how to prevent SQL injections, but I'm not sure that the QueryBuilder
escapes the input?
I found that there is a thing called 'Search Templates', which use mustache. Do they maybe escape the content properly? Are they 'the way to go' to prevent such problems?
I'm not even sure what the problematic user input could be like. When using the QueryBuilder
, I don't think the HTTP METHOD
of the query could be changed.
Maybe scripting could be a problem, but that can be disabled.
To reiterate my question: are code injections a problem for Elasticsearch, and if yes, what are the best ways to mitigate them?
Thanks! :)