import { Client } from '@elastic/elasticsearch'; import service from 'feathers-elasticsearch'; const client = new Client({ node: 'http://localhost:9200' }); app.use('/my-service', service({ Model: client, index: 'my-index', // Security configuration security: { // Query complexity limits maxQueryDepth: 50, // Max nesting for $or/$and/$nested (default: 50) maxArraySize: 10000, // Max items in $in/$nin arrays (default: 10000) // Bulk operation limits maxBulkOperations: 10000, // Max documents in bulk patch/remove (default: 10000) // Document size limits maxDocumentSize: 10485760, // 10MB max document size (default: 10MB) // Query string limits for $sqs maxQueryStringLength: 500, // Max length of $sqs queries (default: 500) // Raw method whitelist (IMPORTANT: empty by default = all disabled) allowedRawMethods: [ 'search', // Allow search operations 'count', // Allow count operations // 'indices.delete', // DON'T enable destructive operations! ], // Cross-index query restrictions allowedIndices: [], // Empty = only service's index allowed // Or specify: ['index1', 'index2'] // Field restrictions for $sqs queries searchableFields: [], // Empty = all fields searchable // Or specify: ['name', 'email', 'bio'] // Error verbosity enableDetailedErrors: false, // true in dev, false in production // Input sanitization enableInputSanitization: true, // Prevent prototype pollution } }));

{ maxQueryDepth: 50, maxArraySize: 10000, maxBulkOperations: 10000, maxDocumentSize: 10485760, // 10MB maxQueryStringLength: 500, allowedRawMethods: [], // ⚠️ ALL RAW METHODS DISABLED allowedIndices: [], // Only default index allowed searchableFields: [], // All fields searchable enableDetailedErrors: process.env.NODE_ENV !== 'production', enableInputSanitization: true }

// v3.x - raw() was unrestricted app.use('/elasticsearch', service({ Model: client, // ... other options })); // v4.0+ - Must whitelist methods app.use('/elasticsearch', service({ Model: client, security: { allowedRawMethods: ['search', 'count'] // Only allow safe read operations } })); app.service('elasticsearch').hooks({ before: { raw: [disallow('external')] // Block from external clients } });

const ALLOWED_RAW_METHODS = new Set(['search', 'count', 'explain']); app.service('elasticsearch').hooks({ before: { raw: [ context => { const method = context.arguments[0]; if (!ALLOWED_RAW_METHODS.has(method)) { throw new errors.MethodNotAllowed(`Method '${method}' is not allowed`); } } ] } });

// Add validation hook app.service('elasticsearch').hooks({ before: { find: [ context => { const { query } = context.params; if (query && query.$sqs) { // Validate query string length if (query.$sqs.$query.length > 500) { throw new errors.BadRequest('Query string too long'); } // Prevent regex patterns that could cause catastrophic backtracking if (/\/\.\*(\.\*)+/.test(query.$sqs.$query)) { throw new errors.BadRequest('Invalid query pattern'); } // Whitelist allowed fields const allowedFields = ['name', 'description', 'tags']; const requestedFields = query.$sqs.$fields || []; for (const field of requestedFields) { const cleanField = field.replace(/\^.*$/, ''); if (!allowedFields.includes(cleanField)) { throw new errors.BadRequest(`Field '${field}' is not searchable`); } } } } ] } });

app.service('elasticsearch').hooks({ before: { find: [ // Limit query complexity context => { const depth = getQueryDepth(context.params.query); if (depth > 50) { throw new errors.BadRequest('Query too complex'); } } ], patch: [ // Restrict bulk patches async context => { if (context.id === null) { // This is a bulk operation - check how many documents would be affected const count = await context.service.find({ ...context.params, paginate: false, query: { ...context.params.query, $limit: 0 } }); const maxBulk = 1000; if (count.total > maxBulk) { throw new errors.BadRequest( `Bulk operation would affect ${count.total} documents, maximum is ${maxBulk}` ); } } } ], remove: [ // Restrict bulk deletes (or disable entirely) context => { if (context.id === null) { throw new errors.MethodNotAllowed('Bulk deletes not allowed'); } } ] } }); // Helper function to calculate query depth function getQueryDepth(query, depth = 0) { if (!query || typeof query !== 'object') return depth; let maxDepth = depth; for (const key of Object.keys(query)) { if (key === '$or' || key === '$and') { const value = query[key]; if (Array.isArray(value)) { for (const item of value) { maxDepth = Math.max(maxDepth, getQueryDepth(item, depth + 1)); } } } } return maxDepth; }

app.service('elasticsearch').hooks({ error: { all: [ context => { if (process.env.NODE_ENV === 'production') { // Log full error server-side console.error('Elasticsearch error:', context.error); // Return generic message to client if (context.error.details) { delete context.error.details; } if (context.error.stack) { delete context.error.stack; } // Use generic messages const genericMessages = { 400: 'Invalid request parameters', 404: 'Resource not found', 409: 'Resource conflict', 500: 'Internal server error' }; const status = context.error.code || 500; context.error.message = genericMessages[status] || genericMessages[500]; } } ] } });

// Option A - Disable $index filter entirely (recommended) app.use('/elasticsearch', service({ Model: client, index: 'my-index', filters: { $index: undefined // Remove $index filter } })); // Option B - Implement index whitelist const allowedIndices = ['my-index', 'my-index-staging']; app.service('elasticsearch').hooks({ before: { all: [ context => { const requestedIndex = context.params.query?.$index; if (requestedIndex && !allowedIndices.includes(requestedIndex)) { throw new errors.Forbidden(`Access to index '${requestedIndex}' is not allowed`); } } ] } });

// Sanitize input data function sanitizeObject(obj) { if (!obj || typeof obj !== 'object') return obj; const dangerous = ['__proto__', 'constructor', 'prototype']; const sanitized = {}; for (const key of Object.keys(obj)) { if (dangerous.includes(key)) { continue; // Skip dangerous keys } const value = obj[key]; sanitized[key] = typeof value === 'object' && value !== null ? sanitizeObject(value) : value; } return sanitized; } app.service('elasticsearch').hooks({ before: { create: [ context => { context.data = sanitizeObject(context.data); } ], update: [ context => { context.data = sanitizeObject(context.data); } ], patch: [ context => { context.data = sanitizeObject(context.data); } ] } });

import { Client } from '@elastic/elasticsearch'; const client = new Client({ node: process.env.ELASTICSEARCH_URL, // Authentication auth: { username: process.env.ES_USERNAME, password: process.env.ES_PASSWORD }, // SSL/TLS ssl: { rejectUnauthorized: true, // Verify certificates ca: fs.readFileSync('./ca.crt'), // CA certificate }, // Performance and DoS protection maxRetries: 3, requestTimeout: 30000, // 30 second timeout sniffOnConnectionFault: false, // Prevent node enumeration maxSockets: 10, // Limit concurrent connections maxFreeSockets: 5 });