do not make an assumption on user-supplied data content (#109425) (#1…

…10686) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Mikhail Shustov <restrry@gmail.com>
elastic · Aug 31, 2021 · 4689cef · 4689cef
1 parent adb6030
commit 4689cef
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/src/core/server/elasticsearch/client/client_config.ts b/src/core/server/elasticsearch/client/client_config.ts
@@ -55,6 +55,9 @@ export function parseClientOptions(
       ...DEFAULT_HEADERS,
       ...config.customHeaders,
     },
+    // do not make assumption on user-supplied data content
+    // fixes https://github.com/elastic/kibana/issues/101944
+    disablePrototypePoisoningProtection: true,
   };
 
   if (config.pingTimeout != null) {