# Do I have to worry about an MVEL attack? **URL:** \ **Category:** Elasticsearch\ **Created:** [January 7, 2013, 10:13am UTC](https://discuss.elastic.co/t/do-i-have-to-worry-about-an-mvel-attack/10247 "2013-01-07T10:13:29Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![chris\_harrington](https://avatars.discourse-cdn.com/v4/letter/c/77aa72/32.png) [@chris\_harrington](https://discuss.elastic.co/u/chris_harrington)\ **Post date:** [January 7, 2013, 10:13am UTC](https://discuss.elastic.co/t/do-i-have-to-worry-about-an-mvel-attack/10247/1 "2013-01-07T10:13:29Z")
If I take in a string variable from a client that will be inserted (or used for updating) a field in ES using MVEL, is it possible for someone to attack my data with some form of escaped String? eg (I hope my example makes sense because I've been trying to wrap my head around this and keep getting confused.) with a field in ES "data": { {"type":"xyz"}, {"type":"abc"} } and an update script String updateScript = "for(item : ctx.\_source.data){if(item.type == ""oldType - ""){ item.type="" + newType + "";}}" Is it possible to supply a String which has escaped characters that could cause harm. newType = "abc"; item=null;"" Bottom line here is essentially do I have worry about being attacked through variable passed in by a client and given to MVEL? Thanks -- ---
**Author:** ![Artem\_Grinblat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/artem_grinblat/32/2327_2.png) [@Artem\_Grinblat](https://discuss.elastic.co/u/Artem_Grinblat)\ **Post date:** [January 7, 2013, 1:59pm UTC](https://discuss.elastic.co/t/do-i-have-to-worry-about-an-mvel-attack/10247/2 "2013-01-07T13:59:46Z")
Of course it's possible! You should always check the data that comes from an external source! Escape the string or make sure there's no special characters in it. Sometimes I use a JSON escape ( JSONValue#escape from [http://code.google.com/p/json-simple/source/browse/trunk/src/main/java/org/json/simple/JSONValue.java](http://code.google.com/p/json-simple/source/browse/trunk/src/main/java/org/json/simple/JSONValue.java) for example ). понедельник, 7 января 2013 г., 14:13:29 UTC+4 пользователь chris harrington написал: > If I take in a string variable from a client that will be inserted (or > used for updating) a field in ES using MVEL, is it possible for someone to > attack my data with some form of escaped String? -- ---
**Author:** ![Igor\_Motov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_motov/32/45193_2.png) [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)\ **Post date:** [January 8, 2013, 3:48am UTC](https://discuss.elastic.co/t/do-i-have-to-worry-about-an-mvel-attack/10247/3 "2013-01-08T03:48:08Z")
Generating script on the client for every update is problematic not only because it opens you to code injection attacks, but also because it's inefficient. If your script will change for every call, elasticsearch will have to parse it again and again. Instead of generating script every time, use static script and pass changing values as script parameters. On Monday, January 7, 2013 8:59:46 AM UTC-5, Artem Grinblat wrote: > Of course it's possible! > You should always check the data that comes from an external source! > > Escape the string or make sure there's no special characters in it. > > Sometimes I use a JSON escape > ( JSONValue#escape from > [Google Code Archive - Long-term storage for Google Code Project Hosting.](http://code.google.com/p/json-simple/source/browse/trunk/src/main/java/org/json/simple/JSONValue.javafor) example ). > > понедельник, 7 января 2013 г., 14:13:29 UTC+4 пользователь chris > harrington написал: > > > If I take in a string variable from a client that will be inserted (or > > used for updating) a field in ES using MVEL, is it possible for someone to > > attack my data with some form of escaped String? -- ---
**Author:** ![chris\_harrington](https://avatars.discourse-cdn.com/v4/letter/c/77aa72/32.png) [@chris\_harrington](https://discuss.elastic.co/u/chris_harrington)\ **Post date:** [January 8, 2013, 1:19pm UTC](https://discuss.elastic.co/t/do-i-have-to-worry-about-an-mvel-attack/10247/4 "2013-01-08T13:19:21Z")
The script isn't on the client, the script is on the server, the example above would be on the server and the client would be passing in 'oldType' and 'newType'. The possibility of attack comes from the String variable passed in from the client. I've been trying to work how the string would look like so I can take appropriate measures but so far all I've been able to do is cause a concurrent modification exception. Map vars= new HashMap(); ArrayList alist = new ArrayList(); alist.add("one"); alist.add("two"); alist.add("1"); vars.put("key", alist); String var = "abc";key.add("444");""; //this represents a String passed in from a client String script = "for(item:key){; if(item=="two"){item += ""+ var + "";}}"; //this represents some script that updates data. MVEL.eval(script, vars);// represents ES evaluating the MVEL. While the MVEL iterates over the ArrayList, the "attack code" tries to insert data, adding to a list while iterating = ConcurrentModificationException I've been trying On Tuesday, 8 January 2013 03:48:08 UTC, Igor Motov wrote: > Generating script on the client for every update is problematic not only > because it opens you to code injection attacks, but also because it's > inefficient. If your script will change for every call, elasticsearch will > have to parse it again and again. Instead of generating script every time, > use static script and pass changing values as script parameters. > > On Monday, January 7, 2013 8:59:46 AM UTC-5, Artem Grinblat wrote: > > > Of course it's possible! > > You should always check the data that comes from an external source! > > > > Escape the string or make sure there's no special characters in it. > > > > Sometimes I use a JSON escape > > ( JSONValue#escape from > > [http://code.google.com/p/json-simple/source/browse/trunk/src/main/java/org/json/simple/JSONValue.javafor](http://code.google.com/p/json-simple/source/browse/trunk/src/main/java/org/json/simple/JSONValue.javafor) example ). > > > > понедельник, 7 января 2013 г., 14:13:29 UTC+4 пользователь chris > > harrington написал: > > > > > If I take in a string variable from a client that will be inserted (or > > > used for updating) a field in ES using MVEL, is it possible for someone to > > > attack my data with some form of escaped String? -- ---
**Author:** ![Igor\_Motov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_motov/32/45193_2.png) [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)\ **Post date:** [January 8, 2013, 2:23pm UTC](https://discuss.elastic.co/t/do-i-have-to-worry-about-an-mvel-attack/10247/5 "2013-01-08T14:23:13Z")
Just to be sure we are on the same page, when I said server and client I meant elasticsearch server and whoever is using it. When elasticsearch server receives a script with set of parameters, it compiles the script first. Then script is executed and set of parameters is passed to the script as a map. So, I was proposing something like this: Map vars= new HashMap(); ArrayList alist = new ArrayList(); alist.add("one"); alist.add("two"); alist.add("1"); vars.put("key", alist); String var = "abc";key.add("444");""; //this represents a String passed in from a client vars.put("var", alist); String script = "for(item:key){; if(item=="two"){item += var;}}"; //this represents some script that updates data. // send script and vars to elasticsearch On Tuesday, January 8, 2013 8:19:21 AM UTC-5, chris harrington wrote: > The script isn't on the client, the script is on the server, the example > above would be on the server and the client would be passing in 'oldType' > and 'newType'. The possibility of attack comes from the String variable > passed in from the client. I've been trying to work how the string would > look like so I can take appropriate measures but so far all I've been able > to do is cause a concurrent modification exception. > > Map vars= new HashMap(); > ArrayList alist = new ArrayList(); > > alist.add("one"); > alist.add("two"); > alist.add("1"); > > vars.put("key", alist); > > String var = "abc";key.add("444");""; //this represents a String > passed in from a client > > String script = "for(item:key){; if(item=="two"){item += ""+ var + > "";}}"; //this represents some script that updates data. > > MVEL.eval(script, vars);// represents ES evaluating the MVEL. > > While the MVEL iterates over the ArrayList, the "attack code" tries to > insert data, adding to a list while iterating = > ConcurrentModificationException > > I've been trying > On Tuesday, 8 January 2013 03:48:08 UTC, Igor Motov wrote: > > > Generating script on the client for every update is problematic not only > > because it opens you to code injection attacks, but also because it's > > inefficient. If your script will change for every call, elasticsearch will > > have to parse it again and again. Instead of generating script every time, > > use static script and pass changing values as script parameters. > > > > On Monday, January 7, 2013 8:59:46 AM UTC-5, Artem Grinblat wrote: > > > > > Of course it's possible! > > > You should always check the data that comes from an external source! > > > > > > Escape the string or make sure there's no special characters in it. > > > > > > Sometimes I use a JSON escape > > > ( JSONValue#escape from > > > [Google Code Archive - Long-term storage for Google Code Project Hosting.](http://code.google.com/p/json-simple/source/browse/trunk/src/main/java/org/json/simple/JSONValue.javafor) example ). > > > > > > понедельник, 7 января 2013 г., 14:13:29 UTC+4 пользователь chris > > > harrington написал: > > > > > > > If I take in a string variable from a client that will be inserted (or > > > > used for updating) a field in ES using MVEL, is it possible for someone to > > > > attack my data with some form of escaped String? -- ---
**Author:** ![chris\_harrington](https://avatars.discourse-cdn.com/v4/letter/c/77aa72/32.png) [@chris\_harrington](https://discuss.elastic.co/u/chris_harrington)\ **Post date:** [January 8, 2013, 3:00pm UTC](https://discuss.elastic.co/t/do-i-have-to-worry-about-an-mvel-attack/10247/6 "2013-01-08T15:00:24Z")
Ah I understand what you mean, I've never seen a reference to using a script like this in the docs, can you point me to some links/docs/articles about using static scripts? All the MVEL strings I use are built like this and then sent to ES via String updateScript = "for(item: \_ctx.source.field){......code......"" +variable - "".....code.....}"; UpdateResponse response = client.prepareUpdate(index, type, id).setScript( updateScript).execute().actionGet(); How would I be able to use static scripts in this situation? On Tuesday, 8 January 2013 14:23:13 UTC, Igor Motov wrote: > Just to be sure we are on the same page, when I said server and client I > meant elasticsearch server and whoever is using it. When elasticsearch > server receives a script with set of parameters, it compiles the script > first. Then script is executed and set of parameters is passed to the > script as a map. So, I was proposing something like this: > > Map vars= new HashMap(); > ArrayList alist = new ArrayList(); > > alist.add("one"); > alist.add("two"); > alist.add("1"); > > vars.put("key", alist); > > String var = "abc";key.add("444");""; //this represents a String > passed in from a client > > vars.put("var", alist); > > String script = "for(item:key){; if(item=="two"){item += var;}}"; //this > represents some script that updates data. > > // send script and vars to elasticsearch > > On Tuesday, January 8, 2013 8:19:21 AM UTC-5, chris harrington wrote: > > > The script isn't on the client, the script is on the server, the example > > above would be on the server and the client would be passing in 'oldType' > > and 'newType'. The possibility of attack comes from the String variable > > passed in from the client. I've been trying to work how the string would > > look like so I can take appropriate measures but so far all I've been able > > to do is cause a concurrent modification exception. > > > > Map vars= new HashMap(); > > ArrayList alist = new ArrayList(); > > > > alist.add("one"); > > alist.add("two"); > > alist.add("1"); > > > > vars.put("key", alist); > > > > String var = "abc";key.add("444");""; //this represents a String > > passed in from a client > > > > String script = "for(item:key){; if(item=="two"){item += ""+ var + > > "";}}"; //this represents some script that updates data. > > > > MVEL.eval(script, vars);// represents ES evaluating the MVEL. > > > > While the MVEL iterates over the ArrayList, the "attack code" tries to > > insert data, adding to a list while iterating = > > ConcurrentModificationException > > > > I've been trying > > On Tuesday, 8 January 2013 03:48:08 UTC, Igor Motov wrote: > > > > > Generating script on the client for every update is problematic not only > > > because it opens you to code injection attacks, but also because it's > > > inefficient. If your script will change for every call, elasticsearch will > > > have to parse it again and again. Instead of generating script every time, > > > use static script and pass changing values as script parameters. > > > > > > On Monday, January 7, 2013 8:59:46 AM UTC-5, Artem Grinblat wrote: > > > > > > > Of course it's possible! > > > > You should always check the data that comes from an external source! > > > > > > > > Escape the string or make sure there's no special characters in it. > > > > > > > > Sometimes I use a JSON escape > > > > ( JSONValue#escape from > > > > [http://code.google.com/p/json-simple/source/browse/trunk/src/main/java/org/json/simple/JSONValue.javafor](http://code.google.com/p/json-simple/source/browse/trunk/src/main/java/org/json/simple/JSONValue.javafor) example ). > > > > > > > > понедельник, 7 января 2013 г., 14:13:29 UTC+4 пользователь chris > > > > harrington написал: > > > > > > > > > If I take in a string variable from a client that will be inserted (or > > > > > used for updating) a field in ES using MVEL, is it possible for someone to > > > > > attack my data with some form of escaped String? -- ---
**Author:** ![Igor\_Motov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_motov/32/45193_2.png) [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)\ **Post date:** [January 8, 2013, 3:16pm UTC](https://discuss.elastic.co/t/do-i-have-to-worry-about-an-mvel-attack/10247/7 "2013-01-08T15:16:54Z")
String updateScript = "for(item: \_ctx.source.field){......code......my\_var .....code.....}"; UpdateResponse response = client.prepareUpdate(index, type, id).setScript( updateScript).addScriptParam("my\_var", variable).execute().actionGet(); On Tuesday, January 8, 2013 10:00:24 AM UTC-5, chris harrington wrote: > Ah I understand what you mean, I've never seen a reference to using a > script like this in the docs, can you point me to some links/docs/articles > about using static scripts? > > All the MVEL strings I use are built like this and then sent to ES via > > String updateScript = "for(item: \_ctx.source.field){......code......"" +variable > > - "".....code.....}"; > > UpdateResponse response = client.prepareUpdate(index, type, id).setScript( > updateScript).execute().actionGet(); > > How would I be able to use static scripts in this situation? > > On Tuesday, 8 January 2013 14:23:13 UTC, Igor Motov wrote: > > > Just to be sure we are on the same page, when I said server and client I > > meant elasticsearch server and whoever is using it. When elasticsearch > > server receives a script with set of parameters, it compiles the script > > first. Then script is executed and set of parameters is passed to the > > script as a map. So, I was proposing something like this: > > > > Map vars= new HashMap(); > > ArrayList alist = new ArrayList(); > > > > alist.add("one"); > > alist.add("two"); > > alist.add("1"); > > > > vars.put("key", alist); > > > > String var = "abc";key.add("444");""; //this represents a String > > passed in from a client > > > > vars.put("var", alist); > > > > String script = "for(item:key){; if(item=="two"){item += var;}}"; //this > > represents some script that updates data. > > > > // send script and vars to elasticsearch > > > > On Tuesday, January 8, 2013 8:19:21 AM UTC-5, chris harrington wrote: > > > > > The script isn't on the client, the script is on the server, the example > > > above would be on the server and the client would be passing in 'oldType' > > > and 'newType'. The possibility of attack comes from the String variable > > > passed in from the client. I've been trying to work how the string would > > > look like so I can take appropriate measures but so far all I've been able > > > to do is cause a concurrent modification exception. > > > > > > Map vars= new HashMap(); > > > ArrayList alist = new ArrayList(); > > > > > > alist.add("one"); > > > alist.add("two"); > > > alist.add("1"); > > > > > > vars.put("key", alist); > > > > > > String var = "abc";key.add("444");""; //this represents a String > > > passed in from a client > > > > > > String script = "for(item:key){; if(item=="two"){item += ""+ var + > > > "";}}"; //this represents some script that updates data. > > > > > > MVEL.eval(script, vars);// represents ES evaluating the MVEL. > > > > > > While the MVEL iterates over the ArrayList, the "attack code" tries to > > > insert data, adding to a list while iterating = > > > ConcurrentModificationException > > > > > > I've been trying > > > On Tuesday, 8 January 2013 03:48:08 UTC, Igor Motov wrote: > > > > > > > Generating script on the client for every update is problematic not > > > > only because it opens you to code injection attacks, but also because it's > > > > inefficient. If your script will change for every call, elasticsearch will > > > > have to parse it again and again. Instead of generating script every time, > > > > use static script and pass changing values as script parameters. > > > > > > > > On Monday, January 7, 2013 8:59:46 AM UTC-5, Artem Grinblat wrote: > > > > > > > > > Of course it's possible! > > > > > You should always check the data that comes from an external source! > > > > > > > > > > Escape the string or make sure there's no special characters in it. > > > > > > > > > > Sometimes I use a JSON escape > > > > > ( JSONValue#escape from > > > > > [Google Code Archive - Long-term storage for Google Code Project Hosting.](http://code.google.com/p/json-simple/source/browse/trunk/src/main/java/org/json/simple/JSONValue.javafor) example ). > > > > > > > > > > понедельник, 7 января 2013 г., 14:13:29 UTC+4 пользователь chris > > > > > harrington написал: > > > > > > > > > > > If I take in a string variable from a client that will be inserted > > > > > > (or used for updating) a field in ES using MVEL, is it possible for someone > > > > > > to attack my data with some form of escaped String? -- ---
**Author:** ![chris\_harrington](https://avatars.discourse-cdn.com/v4/letter/c/77aa72/32.png) [@chris\_harrington](https://discuss.elastic.co/u/chris_harrington)\ **Post date:** [January 8, 2013, 3:25pm UTC](https://discuss.elastic.co/t/do-i-have-to-worry-about-an-mvel-attack/10247/8 "2013-01-08T15:25:05Z")
That's straight forward enough, thanks. And is this approach more secure from injection attacks or will I still have to look into String parsing to make sure everything is clean? On Tuesday, 8 January 2013 15:16:54 UTC, Igor Motov wrote: > String updateScript = "for(item: \_ctx.source.field){......code......my\_var > .....code.....}"; > > UpdateResponse response = client.prepareUpdate(index, type, id).setScript( > updateScript).addScriptParam("my\_var", variable).execute().actionGet(); > > On Tuesday, January 8, 2013 10:00:24 AM UTC-5, chris harrington wrote: > > > Ah I understand what you mean, I've never seen a reference to using a > > script like this in the docs, can you point me to some links/docs/articles > > about using static scripts? > > > > All the MVEL strings I use are built like this and then sent to ES via > > > > String updateScript = "for(item: \_ctx.source.field){......code......"" +variable > > > > - "".....code.....}"; > > > > UpdateResponse response = client.prepareUpdate(index, type, id).setScript > > (updateScript).execute().actionGet(); > > > > How would I be able to use static scripts in this situation? > > > > On Tuesday, 8 January 2013 14:23:13 UTC, Igor Motov wrote: > > > > > Just to be sure we are on the same page, when I said server and client I > > > meant elasticsearch server and whoever is using it. When elasticsearch > > > server receives a script with set of parameters, it compiles the script > > > first. Then script is executed and set of parameters is passed to the > > > script as a map. So, I was proposing something like this: > > > > > > Map vars= new HashMap(); > > > ArrayList alist = new ArrayList(); > > > > > > alist.add("one"); > > > alist.add("two"); > > > alist.add("1"); > > > > > > vars.put("key", alist); > > > > > > String var = "abc";key.add("444");""; //this represents a String > > > passed in from a client > > > > > > vars.put("var", alist); > > > > > > String script = "for(item:key){; if(item=="two"){item += var;}}"; //this > > > represents some script that updates data. > > > > > > // send script and vars to elasticsearch > > > > > > On Tuesday, January 8, 2013 8:19:21 AM UTC-5, chris harrington wrote: > > > > > > > The script isn't on the client, the script is on the server, the > > > > example above would be on the server and the client would be passing in > > > > 'oldType' and 'newType'. The possibility of attack comes from the String > > > > variable passed in from the client. I've been trying to work how the string > > > > would look like so I can take appropriate measures but so far all I've been > > > > able to do is cause a concurrent modification exception. > > > > > > > > Map vars= new HashMap(); > > > > ArrayList alist = new ArrayList(); > > > > > > > > alist.add("one"); > > > > alist.add("two"); > > > > alist.add("1"); > > > > > > > > vars.put("key", alist); > > > > > > > > String var = "abc";key.add("444");""; //this represents a String > > > > passed in from a client > > > > > > > > String script = "for(item:key){; if(item=="two"){item += ""+ var + > > > > "";}}"; //this represents some script that updates data. > > > > > > > > MVEL.eval(script, vars);// represents ES evaluating the MVEL. > > > > > > > > While the MVEL iterates over the ArrayList, the "attack code" tries to > > > > insert data, adding to a list while iterating = > > > > ConcurrentModificationException > > > > > > > > I've been trying > > > > On Tuesday, 8 January 2013 03:48:08 UTC, Igor Motov wrote: > > > > > > > > > Generating script on the client for every update is problematic not > > > > > only because it opens you to code injection attacks, but also because it's > > > > > inefficient. If your script will change for every call, elasticsearch will > > > > > have to parse it again and again. Instead of generating script every time, > > > > > use static script and pass changing values as script parameters. > > > > > > > > > > On Monday, January 7, 2013 8:59:46 AM UTC-5, Artem Grinblat wrote: > > > > > > > > > > > Of course it's possible! > > > > > > You should always check the data that comes from an external source! > > > > > > > > > > > > Escape the string or make sure there's no special characters in it. > > > > > > > > > > > > Sometimes I use a JSON escape > > > > > > ( JSONValue#escape from > > > > > > [http://code.google.com/p/json-simple/source/browse/trunk/src/main/java/org/json/simple/JSONValue.javafor](http://code.google.com/p/json-simple/source/browse/trunk/src/main/java/org/json/simple/JSONValue.javafor) example ). > > > > > > > > > > > > понедельник, 7 января 2013 г., 14:13:29 UTC+4 пользователь chris > > > > > > harrington написал: > > > > > > > > > > > > > If I take in a string variable from a client that will be inserted > > > > > > > (or used for updating) a field in ES using MVEL, is it possible for someone > > > > > > > to attack my data with some form of escaped String? -- ---
**Author:** ![Igor\_Motov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_motov/32/45193_2.png) [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)\ **Post date:** [January 8, 2013, 3:56pm UTC](https://discuss.elastic.co/t/do-i-have-to-worry-about-an-mvel-attack/10247/9 "2013-01-08T15:56:05Z")
It's definitely more secure, it's just a string. It's not parsed or compiled, it's just passed to the script. So, unless you somehow explicitly evaluate it in your script, it cannot be executed. On Tuesday, January 8, 2013 10:25:05 AM UTC-5, chris harrington wrote: > That's straight forward enough, thanks. > > And is this approach more secure from injection attacks or will I still > have to look into String parsing to make sure everything is clean? > > On Tuesday, 8 January 2013 15:16:54 UTC, Igor Motov wrote: > > > String updateScript = "for(item: > > \_ctx.source.field){......code......my\_var.....code.....}"; > > > > UpdateResponse response = client.prepareUpdate(index, type, id).setScript > > (updateScript).addScriptParam("my\_var", variable).execute().actionGet(); > > > > On Tuesday, January 8, 2013 10:00:24 AM UTC-5, chris harrington wrote: > > > > > Ah I understand what you mean, I've never seen a reference to using a > > > script like this in the docs, can you point me to some links/docs/articles > > > about using static scripts? > > > > > > All the MVEL strings I use are built like this and then sent to ES via > > > > > > String updateScript = "for(item: \_ctx.source.field){......code......"" > > > > > > - variable + "".....code.....}"; > > > > > > UpdateResponse response = client.prepareUpdate(index, type, id). > > > setScript(updateScript).execute().actionGet(); > > > > > > How would I be able to use static scripts in this situation? > > > > > > On Tuesday, 8 January 2013 14:23:13 UTC, Igor Motov wrote: > > > > > > > Just to be sure we are on the same page, when I said server and client > > > > I meant elasticsearch server and whoever is using it. When elasticsearch > > > > server receives a script with set of parameters, it compiles the script > > > > first. Then script is executed and set of parameters is passed to the > > > > script as a map. So, I was proposing something like this: > > > > > > > > Map vars= new HashMap(); > > > > ArrayList alist = new ArrayList(); > > > > > > > > alist.add("one"); > > > > alist.add("two"); > > > > alist.add("1"); > > > > > > > > vars.put("key", alist); > > > > > > > > String var = "abc";key.add("444");""; //this represents a String > > > > passed in from a client > > > > > > > > vars.put("var", alist); > > > > > > > > String script = "for(item:key){; if(item=="two"){item += var;}}"; //this > > > > represents some script that updates data. > > > > > > > > // send script and vars to elasticsearch > > > > > > > > On Tuesday, January 8, 2013 8:19:21 AM UTC-5, chris harrington wrote: > > > > > > > > > The script isn't on the client, the script is on the server, the > > > > > example above would be on the server and the client would be passing in > > > > > 'oldType' and 'newType'. The possibility of attack comes from the String > > > > > variable passed in from the client. I've been trying to work how the string > > > > > would look like so I can take appropriate measures but so far all I've been > > > > > able to do is cause a concurrent modification exception. > > > > > > > > > > Map vars= new HashMap(); > > > > > ArrayList alist = new ArrayList(); > > > > > > > > > > alist.add("one"); > > > > > alist.add("two"); > > > > > alist.add("1"); > > > > > > > > > > vars.put("key", alist); > > > > > > > > > > String var = "abc";key.add("444");""; //this represents a String > > > > > passed in from a client > > > > > > > > > > String script = "for(item:key){; if(item=="two"){item += ""+ var + > > > > > "";}}"; //this represents some script that updates data. > > > > > > > > > > MVEL.eval(script, vars);// represents ES evaluating the MVEL. > > > > > > > > > > While the MVEL iterates over the ArrayList, the "attack code" tries to > > > > > insert data, adding to a list while iterating = > > > > > ConcurrentModificationException > > > > > > > > > > I've been trying > > > > > On Tuesday, 8 January 2013 03:48:08 UTC, Igor Motov wrote: > > > > > > > > > > > Generating script on the client for every update is problematic not > > > > > > only because it opens you to code injection attacks, but also because it's > > > > > > inefficient. If your script will change for every call, elasticsearch will > > > > > > have to parse it again and again. Instead of generating script every time, > > > > > > use static script and pass changing values as script parameters. > > > > > > > > > > > > On Monday, January 7, 2013 8:59:46 AM UTC-5, Artem Grinblat wrote: > > > > > > > > > > > > > Of course it's possible! > > > > > > > You should always check the data that comes from an external source! > > > > > > > > > > > > > > Escape the string or make sure there's no special characters in it. > > > > > > > > > > > > > > Sometimes I use a JSON escape > > > > > > > ( JSONValue#escape from > > > > > > > [Google Code Archive - Long-term storage for Google Code Project Hosting.](http://code.google.com/p/json-simple/source/browse/trunk/src/main/java/org/json/simple/JSONValue.javafor) example ). > > > > > > > > > > > > > > понедельник, 7 января 2013 г., 14:13:29 UTC+4 пользователь chris > > > > > > > harrington написал: > > > > > > > > > > > > > > > If I take in a string variable from a client that will be inserted > > > > > > > > (or used for updating) a field in ES using MVEL, is it possible for someone > > > > > > > > to attack my data with some form of escaped String? -- ---
**Author:** ![chris\_harrington](https://avatars.discourse-cdn.com/v4/letter/c/77aa72/32.png) [@chris\_harrington](https://discuss.elastic.co/u/chris_harrington)\ **Post date:** [January 8, 2013, 4:28pm UTC](https://discuss.elastic.co/t/do-i-have-to-worry-about-an-mvel-attack/10247/10 "2013-01-08T16:28:26Z")
Good to know. Thanks for all your help Igor. On Tuesday, 8 January 2013 15:56:05 UTC, Igor Motov wrote: > It's definitely more secure, it's just a string. It's not parsed or > compiled, it's just passed to the script. So, unless you > somehow explicitly evaluate it in your script, it cannot be executed. > > On Tuesday, January 8, 2013 10:25:05 AM UTC-5, chris harrington wrote: > > > That's straight forward enough, thanks. > > > > And is this approach more secure from injection attacks or will I still > > have to look into String parsing to make sure everything is clean? > > > > On Tuesday, 8 January 2013 15:16:54 UTC, Igor Motov wrote: > > > > > String updateScript = "for(item: > > > \_ctx.source.field){......code......my\_var.....code.....}"; > > > > > > UpdateResponse response = client.prepareUpdate(index, type, id). > > > setScript(updateScript).addScriptParam("my\_var", variable).execute(). > > > actionGet(); > > > > > > On Tuesday, January 8, 2013 10:00:24 AM UTC-5, chris harrington wrote: > > > > > > > Ah I understand what you mean, I've never seen a reference to using a > > > > script like this in the docs, can you point me to some links/docs/articles > > > > about using static scripts? > > > > > > > > All the MVEL strings I use are built like this and then sent to ES via > > > > > > > > String updateScript = "for(item: \_ctx.source.field){......code......"" > > > > > > > > - variable + "".....code.....}"; > > > > > > > > UpdateResponse response = client.prepareUpdate(index, type, id). > > > > setScript(updateScript).execute().actionGet(); > > > > > > > > How would I be able to use static scripts in this situation? > > > > > > > > On Tuesday, 8 January 2013 14:23:13 UTC, Igor Motov wrote: > > > > > > > > > Just to be sure we are on the same page, when I said server and client > > > > > I meant elasticsearch server and whoever is using it. When elasticsearch > > > > > server receives a script with set of parameters, it compiles the script > > > > > first. Then script is executed and set of parameters is passed to the > > > > > script as a map. So, I was proposing something like this: > > > > > > > > > > Map vars= new HashMap(); > > > > > ArrayList alist = new ArrayList(); > > > > > > > > > > alist.add("one"); > > > > > alist.add("two"); > > > > > alist.add("1"); > > > > > > > > > > vars.put("key", alist); > > > > > > > > > > String var = "abc";key.add("444");""; //this represents a String > > > > > passed in from a client > > > > > > > > > > vars.put("var", alist); > > > > > > > > > > String script = "for(item:key){; if(item=="two"){item += var;}}"; //this > > > > > represents some script that updates data. > > > > > > > > > > // send script and vars to elasticsearch > > > > > > > > > > On Tuesday, January 8, 2013 8:19:21 AM UTC-5, chris harrington wrote: > > > > > > > > > > > The script isn't on the client, the script is on the server, the > > > > > > example above would be on the server and the client would be passing in > > > > > > 'oldType' and 'newType'. The possibility of attack comes from the String > > > > > > variable passed in from the client. I've been trying to work how the string > > > > > > would look like so I can take appropriate measures but so far all I've been > > > > > > able to do is cause a concurrent modification exception. > > > > > > > > > > > > Map vars= new HashMap(); > > > > > > ArrayList alist = new ArrayList(); > > > > > > > > > > > > alist.add("one"); > > > > > > alist.add("two"); > > > > > > alist.add("1"); > > > > > > > > > > > > vars.put("key", alist); > > > > > > > > > > > > String var = "abc";key.add("444");""; //this represents a > > > > > > String passed in from a client > > > > > > > > > > > > String script = "for(item:key){; if(item=="two"){item += ""+ var > > > > > > +"";}}"; //this represents some script that updates data. > > > > > > > > > > > > MVEL.eval(script, vars);// represents ES evaluating the MVEL. > > > > > > > > > > > > While the MVEL iterates over the ArrayList, the "attack code" tries > > > > > > to insert data, adding to a list while iterating = > > > > > > ConcurrentModificationException > > > > > > > > > > > > I've been trying > > > > > > On Tuesday, 8 January 2013 03:48:08 UTC, Igor Motov wrote: > > > > > > > > > > > > > Generating script on the client for every update is problematic not > > > > > > > only because it opens you to code injection attacks, but also because it's > > > > > > > inefficient. If your script will change for every call, elasticsearch will > > > > > > > have to parse it again and again. Instead of generating script every time, > > > > > > > use static script and pass changing values as script parameters. > > > > > > > > > > > > > > On Monday, January 7, 2013 8:59:46 AM UTC-5, Artem Grinblat wrote: > > > > > > > > > > > > > > > Of course it's possible! > > > > > > > > You should always check the data that comes from an external source! > > > > > > > > > > > > > > > > Escape the string or make sure there's no special characters in it. > > > > > > > > > > > > > > > > Sometimes I use a JSON escape > > > > > > > > ( JSONValue#escape from > > > > > > > > [Google Code Archive - Long-term storage for Google Code Project Hosting.](http://code.google.com/p/json-simple/source/browse/trunk/src/main/java/org/json/simple/JSONValue.javafor) example ). > > > > > > > > > > > > > > > > понедельник, 7 января 2013 г., 14:13:29 UTC+4 пользователь chris > > > > > > > > harrington написал: > > > > > > > > > > > > > > > > > If I take in a string variable from a client that will be inserted > > > > > > > > > (or used for updating) a field in ES using MVEL, is it possible for someone > > > > > > > > > to attack my data with some form of escaped String? -- ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:57am UTC](https://discuss.elastic.co/t/do-i-have-to-worry-about-an-mvel-attack/10247/11 "2017-07-06T02:57:23Z")