Security2.20.1
Field Filter Stripping Fix, Search Stability, Schema Index Validation
Fixed a security issue where field filter restrictions (allowed query config and http.restrictedFields) were only applied when RBAC was enabled; now they are always enforced. Also fixed search correlated flag and schema index JSON validation.
Highlights
Field Filter Always Strips Disallowed Fields
Previously, the allowed query config on a route and http.restrictedFields config were not being applied unless the RBAC flag was enabled. This releases fixes it by removing the RBAC flag requirement. We highly recommend updating to this version as this is a valuable security fix.
Bug Fixes
- framework: Always strip fields that a field filter doesn't allow (#16704) — @shahednasser
- Remove correlated flag on search until it is supported (#16703) — @sradevski
- Disallow using JSON for schema index specification (#16692) — @sradevski
Contributors
Thank you to all contributors who made this release possible:
securityfield-filteringrbacsearchschema
Source: original entry ↗