elasticserach sql查询,并传递参数,以防止sql注入

wfveoks0  于 2021-06-14  发布在  ElasticSearch
关注(0)|答案(1)|浏览(661)

我使用的是elastic search 7.6.2版本。向kibana中不起作用的查询传递参数。当我试图添加params查询不工作在kibana开发工具,如果我们尝试与params查询将工作良好。

POST /_sql?format=txt
                   {
                     "query": "SELECT count(*) as aa  from student where  st_category = ?",
                     "params": [
                       39
                     ]
                   }
       ```  
                     {
                     "error" : {
                       "root_cause" : [
                         {
                           "type" : "x_content_parse_exception",
                           "reason" : "[5:3] [params] Expected START_OBJECT but was: END_ARRAY"
                         }
                       ],
                       "type" : "x_content_parse_exception",
                       "reason" : "[5:3] [sql/query] failed to parse field [params]",
                       "caused_by" : {
                         "type" : "x_content_parse_exception",
                         "reason" : "[5:3] [params] Expected START_OBJECT but was: END_ARRAY"
                       }
                     },
                     "status" : 400
                   }
gab6jxml

gab6jxml1#

在7.6.0集群上复制,但不是在7.9+上,此功能首先出现在7.7上。因此,不幸的是,如果您想使用集群,就必须升级它。

相关问题