A very naive attempt to prevent script injection in Elasticsearch requests. `distance_script_field` is an helper used to help build a complete request.

better_protected.rb

    def distance_script_field(name: "distance", field: "lat_lng", lat:, lng:)
      valid_pattern = /\A[\w]+\Z/
      valid_pattern.match(name) or fail(ArgumentError, "Invalid value for name: #{name.inspect}")
      valid_pattern.match(field) or fail(ArgumentError, "Invalid value for field: #{field.inspect}")
      Float(lat) rescue raise(ArgumentError, "Invalid value for lat: #{lat.inspect}")
      Float(lng) rescue raise(ArgumentError, "Invalid value for lng: #{lng.inspect}")

      {
        name => {
          script: "doc['#{field}'].arcDistanceInKm(lat,lon)",
          params: {
            lat: lat,
            lon: lng
          }
        }
      }
    end

not_protected.rb

    def distance_script_field(name: "distance", field: "lat_lng", lat:, lng:)
      {
        name => {
          script: "doc['#{field}'].arcDistanceInKm(lat,lon)",
          params: {
            lat: lat,
            lon: lng
          }
        }
      }
    end