HighlightBuilder.Field: unable to set highlighting encoder for a field

[jnizet]

Describe the feature:

I'm trying to set the Highlighting encoder option to "html" instead of leaving the default for a specific field, and the Java API apparently has no way to do that (although the ElasticSearch reference documentation says we can override all highlighting settings for each field).

HighlightBuilder and HighlightBuilder.Field both extend AbstractHighlighterBuilder. HighlightBuilder has an encoder(String) method, but HighlighBuilder.Field doesn't.

This is not only annoying, but also a security issue since using the default strategy opens the door to HTML injection.

Also, BTW, the javadoc of HighlightBuilder.encoder() says that the two allowed values are "styled" and "default", but the reference documentation says the possible values are "html" and "default".

Is there something I'm missing, or is it indeed a missing method in the API?

If it's a missing method in the API, my feature request is to add this missing method :-)

Note: I tried to ask the question on the forum before posting the issue, but got no answer in 7 days :-(

[jimczi]

I'm trying to set the Highlighting encoder option to "html" instead of leaving the default for a specific field, and the Java API apparently has no way to do that (although the ElasticSearch reference documentation says we can override all highlighting settings for each field).

Can't you just set the same encoder for all fields in your request ? It's true that you should be able to change the encoder on a per field basis but this is not implemented in the Java API and also in the rest layer. We can add this option in HighlightBuilder.Field but is it really required in your case (why would you use different encoder per field if your concern is html injection) ?

[elasticmachine]

Pinging @elastic/es-search-aggs

[jnizet]

To be completely honest, in this specific case, I could. I have two problems with that approach though:

• I'm using spring-data-elasticsearch, which only exposes an API to specify HighlightBuilder.Field (I know, this is a problem with sring-data-elasticsearch, not with your API)
• I still think it's a valid use-case to have various fields with various types of data. A description could contain arbitrary text from the users, that needs to be html-encoded, while other fields could be safe (because they're sanitized text, or keywords, and thus wouldn't need to be encoded.

I will open an issue for spring-data-elasticsearch too, because half of the problem is with their API.

[mayya-sharipova]

Closing this in favour of a duplicate issue .