In version 8.xx you removed support for disablePrototypePoisoningProtection which is causing our project to run 50% slower

[tomasz-szymanek]

Please bring back support for disablePrototypePoisoningProtection parameter.

🐛 Bug Report

In
#1558
you removed disablePrototypePoisoningProtection configuration option support.

To Reproduce

return new Client({
node: url,
disablePrototypePoisoningProtection: true,
})

From node profiler report:
29430 32.4% T node::fs_dir::DirHandle::Close(v8::FunctionCallbackInfov8::Value const&)
4156 14.1% Function: ^_parse /Users/tszymanek/Projects/frontend/node_modules/secure-json-parse/index.js:7:17
3859 92.9% LazyCompile: *request /Users/tszymanek/Projects/frontend/node_modules/@elastic/transport/lib/Transport.js:273:18

secure-json-parse is considerably slowing our app

Expected behavior

disablePrototypePoisoningProtection should set 'ignore' option in secure-json-parse usage in @elastic/transport.

Your Environment

• node version: 18
• @elastic/elasticsearch version: 8.5 but it lacks this option on latest also
• os: Mac

[tomasz-szymanek]

@JoshMock I just can't believe that you have marked it as an enhancement. Clearly one of the flags from your own documentation is not working.

https://www.elastic.co/guide/en/elasticsearch/client/javascript-api/current/basic-config.html

[JoshMock]

It looks like fixing that detail in the docs was overlooked when we released the 8.0 client, when it was removed. I'm not certain why it was removed because I was not the maintainer at the time.

But 7.x to 8.0 is a breaking change, so it's totally acceptable for us to drop a feature between the two. So bringing it back in 8.x is an enhancement.

Ultimately, the label isn't going to affect the priority of this work. It's just a way for us to measure how many of each type of request we get over time.

If you'd like to see this sooner rather than later, you're more than welcome to submit a PR.

[tomasz-szymanek]

@JoshMock Thanks for the response, I will prepare PR soon.

[tomasz-szymanek]

@JoshMock I added PR to elastic-transport-js making JSON.parse a default parser, unless elasticsearch-js makes changes needed to enable safe parsing. It doesn't change elastic-transport-js API, just making sure that safe parser isn't invoked when it's not needed.

[JoshMock]

It turns out that disablePrototypePoisoninProtection is true by default, so by not setting any value you get the best performance possible.

However, that option was being completely ignored when any other value was set. The docs were also incorrect about the default being true. These two issues have been fixed in #2380, and the change will be included in 8.16.0.