kuzzle 2.15.0 → 2.15.1

package/lib/service/storage/elasticsearch.js

@@ -128,12 +128,11 @@ class ElasticSearch extends Service {
       '_source_includes'
     ];
 
-    // Forbidden keys in a query
-    this.scriptKeys = [
-      'script',
-      '_script'
-    ];
-
+    /**
+     * Only allow stored-scripts in queries
+     */
+    this.scriptKeys = ['script', '_script'];
+    this.scriptAllowedArgs = ['id', 'params'];
 
     this.maxScrollDuration = this._loadMsConfig('maxScrollDuration');
 
@@ -2979,14 +2978,20 @@ class ElasticSearch extends Service {
   }
 
   /**
-   * Throw if any script keyword is contained in the object
+   * Throw if a script is used in the query.
+   *
+   * Only Stored Scripts are accepted
    *
    * @param {Object} object
    */
-  _scriptCheck(object) {
+  _scriptCheck (object) {
     for (const [key, value] of Object.entries(object)) {
       if (this.scriptKeys.includes(key)) {
-        throw kerror.get('invalid_query_keyword', key);
+        for (const scriptArg of Object.keys(value)) {
+          if (! this.scriptAllowedArgs.includes(scriptArg)) {
+            throw kerror.get('invalid_query_keyword', `${key}.${scriptArg}`);
+          }
+        }
       }
       // Every object must be checked here, even the ones nested into an array
       else if (typeof value === 'object' && value !== null) {

package/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "kuzzle",
-  "version": "2.15.0",
+  "version": "2.15.1",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
@@ -2471,9 +2471,9 @@
       "dev": true
     },
     "eslint": {
-      "version": "8.2.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.2.0.tgz",
-      "integrity": "sha512-erw7XmM+CLxTOickrimJ1SiF55jiNlVSp2qqm0NuBWPtHYQCegD5ZMaW0c3i5ytPqL+SSLaCxdvQXFPLJn+ABw==",
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.3.0.tgz",
+      "integrity": "sha512-aIay56Ph6RxOTC7xyr59Kt3ewX185SaGnAr8eWukoPLeriCrvGjvAubxuvaXOfsxhtwV5g0uBOsyhAom4qJdww==",
       "dev": true,
       "requires": {
         "@eslint/eslintrc": "^1.0.4",
@@ -2485,10 +2485,10 @@
         "doctrine": "^3.0.0",
         "enquirer": "^2.3.5",
         "escape-string-regexp": "^4.0.0",
-        "eslint-scope": "^6.0.0",
+        "eslint-scope": "^7.1.0",
         "eslint-utils": "^3.0.0",
-        "eslint-visitor-keys": "^3.0.0",
-        "espree": "^9.0.0",
+        "eslint-visitor-keys": "^3.1.0",
+        "espree": "^9.1.0",
         "esquery": "^1.4.0",
         "esutils": "^2.0.2",
         "fast-deep-equal": "^3.1.3",
@@ -2563,9 +2563,9 @@
           "dev": true
         },
         "eslint-scope": {
-          "version": "6.0.0",
-          "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-6.0.0.tgz",
-          "integrity": "sha512-uRDL9MWmQCkaFus8RF5K9/L/2fn+80yoW3jkD53l4shjCh26fCtvJGasxjUqP5OT87SYTxCVA3BwTUzuELx9kA==",
+          "version": "7.1.0",
+          "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-7.1.0.tgz",
+          "integrity": "sha512-aWwkhnS0qAXqNOgKOK0dJ2nvzEbhEvpy8OlJ9kZ0FeZnA6zpjv1/Vei+puGFFX7zkPCkHHXb7IDX3A+7yPrRWg==",
           "dev": true,
           "requires": {
             "esrecurse": "^4.3.0",
@@ -2573,14 +2573,14 @@
           }
         },
         "espree": {
-          "version": "9.0.0",
-          "resolved": "https://registry.npmjs.org/espree/-/espree-9.0.0.tgz",
-          "integrity": "sha512-r5EQJcYZ2oaGbeR0jR0fFVijGOcwai07/690YRXLINuhmVeRY4UKSAsQPe/0BNuDgwP7Ophoc1PRsr2E3tkbdQ==",
+          "version": "9.1.0",
+          "resolved": "https://registry.npmjs.org/espree/-/espree-9.1.0.tgz",
+          "integrity": "sha512-ZgYLvCS1wxOczBYGcQT9DDWgicXwJ4dbocr9uYN+/eresBAUuBu+O4WzB21ufQ/JqQT8gyp7hJ3z8SHii32mTQ==",
           "dev": true,
           "requires": {
-            "acorn": "^8.5.0",
+            "acorn": "^8.6.0",
             "acorn-jsx": "^5.3.1",
-            "eslint-visitor-keys": "^3.0.0"
+            "eslint-visitor-keys": "^3.1.0"
           }
         },
         "estraverse": {
@@ -3621,9 +3621,9 @@
       }
     },
     "ioredis": {
-      "version": "4.28.0",
-      "resolved": "https://registry.npmjs.org/ioredis/-/ioredis-4.28.0.tgz",
-      "integrity": "sha512-I+zkeeWp3XFgPT2CtJKxvaF5FjGBGt4yGYljRjQecdQKteThuAsKqffeF1lgHVlYnuNeozRbPOCDNZ7tDWPeig==",
+      "version": "4.28.1",
+      "resolved": "https://registry.npmjs.org/ioredis/-/ioredis-4.28.1.tgz",
+      "integrity": "sha512-7gcrUJEcPHWy+eEyq6wIZpXtfHt8crhbc5+z0sqrnHUkwBblXinygfamj+/jx83Qo+2LW3q87Nj2VsuH6BF2BA==",
       "requires": {
         "cluster-key-slot": "^1.1.0",
         "debug": "^4.3.1",
@@ -4401,9 +4401,9 @@
       }
     },
     "long": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/long/-/long-5.1.0.tgz",
-      "integrity": "sha512-eNc10JP6ezXp/qxXZlKS4OHAKNae3je9LUkjmXPDEa+Iidlz0n4nFi/9LT+GOgcayMWhykLoISN+v0THeOiWQQ=="
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/long/-/long-5.2.0.tgz",
+      "integrity": "sha512-9RTUNjK60eJbx3uz+TEGF7fUr29ZDxR5QzXcyDpeSfeH28S9ycINflOgOlppit5U+4kNTe83KQnMEerw7GmE8w=="
     },
     "lower-case": {
       "version": "1.1.4",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "kuzzle",
   "author": "The Kuzzle Team <support@kuzzle.io>",
-  "version": "2.15.0",
+  "version": "2.15.1",
   "description": "Kuzzle is an open-source solution that handles all the data management through a secured API, with a large choice of protocols.",
   "bin": {
     "kuzzle": "bin/start-kuzzle-server"
@@ -50,7 +50,7 @@
     "dumpme": "^1.0.3",
     "eventemitter3": "^4.0.7",
     "inquirer": "^8.2.0",
-    "ioredis": "^4.28.0",
+    "ioredis": "^4.28.1",
     "js-yaml": "^4.1.0",
     "json-stable-stringify": "^1.0.1",
     "json2yaml": "^1.1.0",
@@ -61,7 +61,7 @@
     "kuzzle-sdk": "7.7.6",
     "kuzzle-vault": "^2.0.4",
     "lodash": "4.17.21",
-    "long": "^5.1.0",
+    "long": "^5.2.0",
     "moment": "^2.29.1",
     "ms": "^2.1.3",
     "murmurhash-native": "^3.5.0",
@@ -96,7 +96,7 @@
     "codecov": "^3.8.3",
     "cucumber": "^6.0.5",
     "ergol": "^1.0.1",
-    "eslint": "^8.2.0",
+    "eslint": "^8.3.0",
     "mocha": "^9.1.3",
     "mock-require": "^3.0.3",
     "mqtt": "^4.2.8",