From 3b3a7305becbe4441f13b31d6fede3f32a1e4173 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Sat, 5 Oct 2024 00:08:21 +1000
Subject: [PATCH] [8.15] [Security Solution] Improve regexes processing KQL
 (#194215) (#194940)

# Backport

This will backport the following commits from `main` to `8.15`:
- [[Security Solution] Improve regexes processing KQL
(#194215)](https://github.com/elastic/kibana/pull/194215)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Marshall
Main","email":"55718608+marshallmain@users.noreply.github.com"},"sourceCommit":{"committedDate":"2024-10-04T12:22:10Z","message":"[Security
Solution] Improve regexes processing KQL (#194215)\n\n##
Summary\r\n\r\nSee linked
ticket","sha":"6d8f85e8f5e93b40696200946a4e2f696ce967fe","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","backport:all-open"],"title":"[Security
Solution] Improve regexes processing
KQL","number":194215,"url":"https://github.com/elastic/kibana/pull/194215","mergeCommit":{"message":"[Security
Solution] Improve regexes processing KQL (#194215)\n\n##
Summary\r\n\r\nSee linked
ticket","sha":"6d8f85e8f5e93b40696200946a4e2f696ce967fe"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/194215","number":194215,"mergeCommit":{"message":"[Security
Solution] Improve regexes processing KQL (#194215)\n\n##
Summary\r\n\r\nSee linked
ticket","sha":"6d8f85e8f5e93b40696200946a4e2f696ce967fe"}}]}]
BACKPORT-->

Co-authored-by: Marshall Main <55718608+marshallmain@users.noreply.github.com>
---
 .../components/ml/conditional_links/remove_kql_variables.ts     | 2 +-
 .../ml/conditional_links/replace_kql_commas_with_or.ts          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/common/components/ml/conditional_links/remove_kql_variables.ts b/x-pack/plugins/security_solution/public/common/components/ml/conditional_links/remove_kql_variables.ts
index 18ad035debf08..f7730f650d4ee 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml/conditional_links/remove_kql_variables.ts
+++ b/x-pack/plugins/security_solution/public/common/components/ml/conditional_links/remove_kql_variables.ts
@@ -13,7 +13,7 @@ export const operators = ['and', 'or', 'not'];
 
 export const removeKqlVariablesUsingRegex = (expression: string) => {
   const myRegexp =
-    /(\s+)*(and|or|not){0,1}(\s+)*([\w\.\-\[\]]+)\s*:\s*"(\$[\w\.\-\(\)\[\]]+\$)"(\s+)*(and|or|not){0,1}(\s+)*/g;
+    /(\s*)(and|or|not){0,1}(\s*)([\w\.\-\[\]]+)\s*:\s*"(\$[\w\.\-\(\)\[\]]+\$)"(\s*)(and|or|not){0,1}(\s*)/g;
   return expression.replace(myRegexp, replacer);
 };
 
diff --git a/x-pack/plugins/security_solution/public/common/components/ml/conditional_links/replace_kql_commas_with_or.ts b/x-pack/plugins/security_solution/public/common/components/ml/conditional_links/replace_kql_commas_with_or.ts
index 1f96615811fc7..2179495ad7205 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml/conditional_links/replace_kql_commas_with_or.ts
+++ b/x-pack/plugins/security_solution/public/common/components/ml/conditional_links/replace_kql_commas_with_or.ts
@@ -22,7 +22,7 @@ export const replacement = (match: string, p1: string, p2: string) => {
 };
 
 export const replaceKqlCommasWithOrUsingRegex = (expression: string) => {
-  const myRegexp = /([\w\.\-\[\]]+)\s*:\s*"(([\w\.\-\(\)\[\]]+,[\w\.\-\(\)\[\]]+){1,})"/g;
+  const myRegexp = /([\w\.\-\[\]]+)\s*:\s*"(([\w\.\-\(\)\[\]]+)(,[\w\.\-\(\)\[\]]+){1,})"/g;
   return expression.replace(myRegexp, replacement);
 };