Open rimutaka opened 2 years ago
Building dynamic ES queries without parameters feels totally wrong. For example:
GET dev/_search { "aggs": { "suggestions": { "terms": { "field": "report.tech.pkgs_kw.k.keyword", "include": "mon.*" } } }, "size": 0 }
where "include": "mon.*" is a dynamic field filled with user input. It allows Regex, so has to be thoroughly validated and escaped.
"include": "mon.*"
There should be a way of doing it via params like in SQL.
Building dynamic ES queries without parameters feels totally wrong. For example:
where
"include": "mon.*"is a dynamic field filled with user input. It allows Regex, so has to be thoroughly validated and escaped.There should be a way of doing it via params like in SQL.