4 ms·
Once a customer was able to destroy an old ES cluster because they copy pasted some text from a PDF into a search box ... that text got sent directly to the ES
by Patrol8394 4y ago
Once a customer was able to destroy an old ES cluster because they copy pasted some text from a PDF into a search box ... that text got sent directly to the ES cluster without much escaping ... there were lots of "*" in there.
The query complexity exploded, ES ran out of memory, and the index got corrupted and I don't remember why, it could not recover.
We had to re-index all the data. Lots of fun.
Lesson learned: prepare for the impossible, keep your infrastructure up to date, escape queries :)
- ffhhj 4y agoMaybe escaping the character wouldn't help if every * is telling the server to process a long loop, but some max range or time to perform the task. I can't tell which company, but I managed to do exactly that you described a few months ago, with a valid query, and it's one of those companies you can guess if I tell you the first letter of its name.
- rawoke083600 4y agoYup seen that in a few online "stores" or companies where they use SOLR or ES. Putting in '' will make boxes explode* (ok not really). What is twice is bad as that the worst of these, fail (at least to my eye) on two fronts. 1) Allowing SINGLE character searches. I.e No min query-length. 2) Not escaping querying - lucene(solr/es) syntax. You can sometimes see the front-facing "html/js/api" is just a thin layer over ES/SOLR.(Which is not bad by itself) it's when you don't know the limitations or what sort of queries are x100 harder to do than orders.