diff --git a/CHANGELOG.md b/CHANGELOG.md index 33ef68cdb412..74126eafd024 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -56,7 +56,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) - [Vis Builder] Add app filter and query persistence without using state container ([#3100](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3100)) - [Optimizer] Increase timeout waiting for the exiting of an optimizer worker ([#3193](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3193)) - [Data] Update `createAggConfig` so that newly created configs can be added to beginning of `aggConfig` array ([#3160](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3160)) - +- Add disablePrototypePoisoningProtection configuration to prevent JS client from erroring when cluster utilizes JS reserved words ([#2992](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2992)) ### 🐛 Bug Fixes diff --git a/config/opensearch_dashboards.yml b/config/opensearch_dashboards.yml index 4d81b0b3be69..6bb4f63bbbde 100644 --- a/config/opensearch_dashboards.yml +++ b/config/opensearch_dashboards.yml @@ -107,6 +107,11 @@ # Logs queries sent to OpenSearch. Requires logging.verbose set to true. #opensearch.logQueries: false +# Disables errors from the OpenSearch JS client and enables you to utilize protected words such as: 'boolean', 'proto', 'constructor'. +# within cluster. By default, OpenSearch Dashboards and the client will protect you against prototype poisoning attacks. +# WARNING: Index patterns are user-supplied data. Disabling this will place the expectation that you are handling the data safely. +#opensearch.disablePrototypePoisoningProtection: false + # Specifies the path where OpenSearch Dashboards creates the process ID file. #pid.file: /var/run/opensearchDashboards.pid diff --git a/src/core/server/opensearch/client/client_config.test.ts b/src/core/server/opensearch/client/client_config.test.ts index d32508ec43aa..b3d1ff95d7dc 100644 --- a/src/core/server/opensearch/client/client_config.test.ts +++ b/src/core/server/opensearch/client/client_config.test.ts @@ -184,6 +184,24 @@ describe('parseClientOptions', () => { ] `); }); + + it('`disablePrototypePoisoningProtection` option', () => { + expect( + parseClientOptions(createConfig({ disablePrototypePoisoningProtection: false }), false) + .disablePrototypePoisoningProtection + ).toEqual(false); + expect( + parseClientOptions(createConfig({ disablePrototypePoisoningProtection: true }), false) + .disablePrototypePoisoningProtection + ).toEqual(true); + + expect( + parseClientOptions(createConfig({}), false).disablePrototypePoisoningProtection + ).toBeUndefined(); + expect( + parseClientOptions(createConfig({}), true).disablePrototypePoisoningProtection + ).toBeUndefined(); + }); }); describe('authorization', () => { diff --git a/src/core/server/opensearch/client/client_config.ts b/src/core/server/opensearch/client/client_config.ts index 6746ee5648ed..0432bb8ddfd6 100644 --- a/src/core/server/opensearch/client/client_config.ts +++ b/src/core/server/opensearch/client/client_config.ts @@ -52,6 +52,7 @@ export type OpenSearchClientConfig = Pick< | 'hosts' | 'username' | 'password' + | 'disablePrototypePoisoningProtection' > & { memoryCircuitBreaker?: | OpenSearchConfig['memoryCircuitBreaker'] @@ -115,6 +116,10 @@ export function parseClientOptions(config: OpenSearchClientConfig, scoped: boole ); } + if (config.disablePrototypePoisoningProtection != null) { + clientOptions.disablePrototypePoisoningProtection = config.disablePrototypePoisoningProtection; + } + return clientOptions; } diff --git a/src/core/server/opensearch/opensearch_config.test.ts b/src/core/server/opensearch/opensearch_config.test.ts index 25cbee718d00..d7a17c12d293 100644 --- a/src/core/server/opensearch/opensearch_config.test.ts +++ b/src/core/server/opensearch/opensearch_config.test.ts @@ -72,6 +72,7 @@ test('set correct defaults', () => { OpenSearchConfig { "apiVersion": "7.x", "customHeaders": Object {}, + "disablePrototypePoisoningProtection": undefined, "healthCheckDelay": "PT2.5S", "hosts": Array [ "http://localhost:9200", diff --git a/src/core/server/opensearch/opensearch_config.ts b/src/core/server/opensearch/opensearch_config.ts index 9b7bdff21cdc..fee26c354fbe 100644 --- a/src/core/server/opensearch/opensearch_config.ts +++ b/src/core/server/opensearch/opensearch_config.ts @@ -142,6 +142,7 @@ export const configSchema = schema.object({ }), schema.boolean({ defaultValue: false }) ), + disablePrototypePoisoningProtection: schema.maybe(schema.boolean({ defaultValue: false })), }); const deprecations: ConfigDeprecationProvider = ({ renameFromRoot, renameFromRootWithoutMap }) => [ @@ -318,6 +319,12 @@ export class OpenSearchConfig { */ public readonly customHeaders: OpenSearchConfigType['customHeaders']; + /** + * Specifies whether the client should attempt to protect against reserved words + * or not. + */ + public readonly disablePrototypePoisoningProtection?: boolean; + constructor(rawConfig: OpenSearchConfigType) { this.ignoreVersionMismatch = rawConfig.ignoreVersionMismatch; this.apiVersion = rawConfig.apiVersion; @@ -338,6 +345,7 @@ export class OpenSearchConfig { this.username = rawConfig.username; this.password = rawConfig.password; this.customHeaders = rawConfig.customHeaders; + this.disablePrototypePoisoningProtection = rawConfig.disablePrototypePoisoningProtection; const { alwaysPresentCertificate, verificationMode } = rawConfig.ssl; const { key, keyPassphrase, certificate, certificateAuthorities } = readKeyAndCerts(rawConfig); diff --git a/src/dev/build/tasks/os_packages/docker_generator/resources/bin/opensearch-dashboards-docker b/src/dev/build/tasks/os_packages/docker_generator/resources/bin/opensearch-dashboards-docker index a5cefbc2397c..de9ec4e4b5de 100755 --- a/src/dev/build/tasks/os_packages/docker_generator/resources/bin/opensearch-dashboards-docker +++ b/src/dev/build/tasks/os_packages/docker_generator/resources/bin/opensearch-dashboards-docker @@ -50,6 +50,7 @@ opensearch_dashboards_vars=( opensearch.ssl.truststore.password opensearch.ssl.verificationMode opensearch.username + opensearch.disablePrototypePoisoningProtection i18n.locale interpreter.enableInVisualize opensearchDashboards.autocompleteTerminateAfter