title: Preventing NoSQL injections with Elasticsearch
body: <p>I'm building an Elasticsearch query using <code>QueryBuilders</code> in my backend. The cluster is not directly exposed to the internet, and only accessed through the backend. </p>
  
  <p>I've noticed that I am providing it with un-santized user input, and it reminded me of SQL injections. I know how to prevent SQL injections, but I'm not sure that the <code>QueryBuilder</code> escapes the input?</p>
  
  <p>I found that there is a thing called 'Search Templates', which use mustache. Do they maybe escape the content properly? Are they 'the way to go' to prevent such problems?</p>
  
  <p>I'm not even sure what the problematic user input could be like. When using the <code>QueryBuilder</code>, I don't think the <code>HTTP METHOD</code> of the query could be changed.</p>
  
  <p>Maybe scripting could be a problem, but that can be disabled.</p>
  
  <p>To reiterate my question: are code injections a problem for Elasticsearch, and if yes, what are the best ways to mitigate them?</p>
  
  <p>Thanks! :)</p>