dotCMS / dotCMS/core

Prevent unbound queries hitting ES

Open
#32,780 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

  • #32782 by @wezell — closed without merging
OKR : Customer Support stale Team : Security Type : Defect
Dominant language
Java
Stars
970
Forks
486
Avg merge
3d 33m
Merged PRs (30d)
170

Description

Problem Statement

We need to protect ES from our endpoints which allow fuzzy queries with no "must match" constraints on them.

Steps to Reproduce

https://docs.google.com/document/d/1CMy0ZxzD8\_uM85Ndp2iU-E0yn7jvbyuB6YRzhm7q8VI/edit?tab=t.0

Acceptance Criteria

Should not allow unbound queries

dotCMS Version

latest

Proposed Objective

Please Select

Proposed Priority

Please Select

External Links... Slack Conversations, Support Tickets, Figma Designs, etc.

No response

Assumptions & Initiation Needs

No response

Quality Assurance Notes & Workarounds

No response

Sub-Tasks & Estimates

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked reproduction document and the endpoints that permit fuzzy queries, then trace how those requests reach Elasticsearch. Confirm which queries lack a must-match constraint and use the acceptance criterion to verify that unbound queries are rejected. The linked pull request #32782 is closed, so check its history for prior investigation before starting.

Written by the indexing model from the issue text.

Assessment

Tech stack
elasticsearch, java
Domain
backend, search
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.