habsi/elasticsearch-js
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add note about prototype poisoning protection perf (#1503)

Browse Source
This commit is contained in:
Tomas Della Vedova
2021-07-24 17:49:05 +02:00
committed by GitHub
parent 6686316433
commit 728868f3ea
1 changed files with 31 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
docs/basic-config.asciidoc
View File

@ -256,3 +256,24 @@ const client = new Client({
_Default:_ `false`
|===
[discrete]
==== Performances considerations
By default, the client will protection you against prototype poisoning attacks.
Read https://web.archive.org/web/20200319091159/https://hueniverse.com/square-brackets-are-the-enemy-ff5b9fd8a3e8?gi=184a27ee2a08[this article] to learn more.
If needed you can disable prototype poisoning protection entirely or one of the two checks.
Read the `secure-json-parse` https://github.com/fastify/secure-json-parse[documentation] to learn more.
While it's good to be safe, you should know that security always comes with a cost.
With big enough payloads, this security check could causea drop in the overall performances,
which might be a problem for your application.
If you know you can trust the data stored in Elasticsearch, you can safely disable this check.
[source,js]
----
const client = new Client({
disablePrototypePoisoningProtection: true
})
----