Disable dynamic querys by default, to avoid remote code execution.

[jannylund]

Elasticsearch defaults to support dynamic querys, which introduces a risk for remote code execution. This is supposedly disabled by default in newer versions of ES, but for now, I suggest setting it to false in the default configuration is better than nothing.

For more information, please see http://bouk.co/blog/elasticsearch-rce/

Br,
Jan

[nboire]

Hello @jannylund,
For information, you can actually configure your specific settings of elacticsearch by define your specific config on your application.conf.

elasticsearch.config.resource="elasticsearch-specific.yml"

[jannylund]

@nboire yes, I know, I did that in my app. But this still makes sense to disable unless someone specifically needs it activated.

[songoo]

We got compromised server by this security hole, some default config after instalation would be welcomed in future.