Skip to content

Foreach processor vulnerable to modifying field during iteration #62790

Closed
@probakowski

Description

@probakowski

Elasticsearch version (bin/elasticsearch --version): 7.5 and later

Plugins installed: []

JVM version (java -version):

OS version (uname -a if on a Unix-like system):

Description of the problem including expected versus actual behavior:
Currently when processor used inside foreach modifies field, that foreach is iterating over, it can leads to unexpected results. Especially when it appends anything to the field foreach will iterate over new items as well which leads to infinite loop and it will eventually bring the whole cluster down.

Steps to reproduce:

POST /_ingest/pipeline/_simulate
{
  "pipeline": {
    "description": "do something",
    "processors": [
      {
        "foreach": {
          "field": "names",
          "processor": {
            "append": {
              "field": "names",
              "value": "whatever"
            }
          }
        }
      }
    ]
  },
  "docs": [
    {
      "_index": "index",
      "_id": "id",
      "_source": {
        "names": [
          "anything"
        ]
      }
    }
  ]
}

You can invoke it couple of times to make effect faster. Eventually cluster will become unresponsive. On 7.7 and later it should fail pretty fast and nothing will work, on previous versions it will accumulate over time (it took around a day for my cloud instance without any other traffic) and will cause all sorts of slowness (like Kibana loading in 1min or just throwing 500 error)

Relates to #50514 and #51104

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions