fix(elasticsearch): validate filter keys and values to prevent term injection (#5980)

Signed-off-by: Hrushikesh Yadav <yadavhrushikesh65@gmail.com>

mem0/vector_stores/elasticsearch.py

@@ -1,4 +1,5 @@
 import logging
+import re
 from typing import Any, Dict, List, Optional
 
 try:
@@ -21,6 +22,19 @@ class OutputData(BaseModel):
     payload: Dict
 
 
+_SAFE_FILTER_KEY = re.compile(r"^[a-zA-Z_][a-zA-Z0-9_]*$")
+
+
+def _validate_filter(key: str, value: Any) -> None:
+    if not isinstance(key, str) or not _SAFE_FILTER_KEY.match(key):
+        raise ValueError(f"Invalid filter key: {key!r}")
+    if not isinstance(value, (str, int, float, bool)):
+        raise ValueError(
+            f"Filter value for {key!r} must be str, int, float, or bool, "
+            f"got {type(value).__name__}"
+        )
+
+
 class ElasticsearchDB(VectorStoreBase):
     def __init__(self, **kwargs):
         config = ElasticsearchConfig(**kwargs)
@@ -154,6 +168,7 @@ class ElasticsearchDB(VectorStoreBase):
             if filters:
                 filter_conditions = []
                 for key, value in filters.items():
+                    _validate_filter(key, value)
                     filter_conditions.append({"term": {f"metadata.{key}": value}})
                 search_query["knn"]["filter"] = {"bool": {"must": filter_conditions}}
 
@@ -192,6 +207,7 @@ class ElasticsearchDB(VectorStoreBase):
         if filters:
             filter_conditions = []
             for key, value in filters.items():
+                _validate_filter(key, value)
                 filter_conditions.append({"term": {f"metadata.{key}": value}})
             bool_query["filter"] = filter_conditions
 
@@ -262,6 +278,7 @@ class ElasticsearchDB(VectorStoreBase):
         if filters:
             filter_conditions = []
             for key, value in filters.items():
+                _validate_filter(key, value)
                 filter_conditions.append({"term": {f"metadata.{key}": value}})
             query["query"] = {"bool": {"must": filter_conditions}}