Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix code scanning alert no. 456: Incomplete string escaping or encoding #193909

Merged
merged 1 commit into from
Sep 25, 2024
Merged

Fix code scanning alert no. 456: Incomplete string escaping or encoding #193909

merged 1 commit into from
Sep 25, 2024

Conversation

smith
Copy link
Contributor

@smith smith commented Sep 24, 2024 •
edited by kibanamachine
Loading

Fixes https://github.com/elastic/kibana/security/code-scanning/456

To fix the problem, we need to ensure that backslashes are also escaped in the value string. This can be done by first replacing backslashes with double backslashes and then replacing double quotes with escaped double quotes. This ensures that all occurrences of backslashes and double quotes are properly escaped.

  • Modify the value.replace call to first escape backslashes and then escape double quotes.
  • The changes will be made in the createFilterFromOptions function, specifically on line 128.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

@smith @github-advanced-security
Fix code scanning alert no. 456: Incomplete string escaping or encoding
998d2a8 
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@obltmachine
Copy link

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

  • /oblt-deploy : Deploy a Kibana instance using the Observability test environments.
  • run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

@smith smith added backport:all-open Backport to all branches that could still receive a release release_note:fix labels Sep 24, 2024
@smith smith marked this pull request as ready for review September 24, 2024 18:42
@smith smith requested a review from a team as a code owner September 24, 2024 18:42
@kibana-ci
Copy link
Collaborator

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #56 / Journey[many_fields_discover] Expand the first document

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
infra 1.6MB 1.6MB +22.0B

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@botelastic botelastic bot added the ci:project-deploy-observability Create an Observability project label Sep 25, 2024
@smith smith merged commit 7458ff1 into main Sep 25, 2024
28 checks passed
@smith smith deleted the autofix/alert-456-38eadb1041 branch September 25, 2024 21:30
@kibanamachine
Copy link
Contributor

💔 All backports failed

Status Branch Result
❌ 7.17 Backport failed because of merge conflicts
❌ 8.15 Backport failed because of merge conflicts
❌ 8.x Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 193909

Questions ?

Please refer to the Backport tool documentation

@kibanamachine kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label Sep 30, 2024
@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

1 similar comment
@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

1 similar comment
@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add the label auto-backport or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

10 similar comments
@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

6 similar comments
@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

@kibanamachine
Copy link
Contributor

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 193909 locally

This was referenced Oct 30, 2024
Merged
Merged
smith added a commit to smith/kibana that referenced this pull request Oct 30, 2024
@smith
Fix code scanning alert no. 456: Incomplete string escaping or encodi…
de435f1 
…ng (elastic#193909)

Fixes
[https://github.com/elastic/kibana/security/code-scanning/456](https://github.com/elastic/kibana/security/code-scanning/456)

To fix the problem, we need to ensure that backslashes are also escaped
in the `value` string. This can be done by first replacing backslashes
with double backslashes and then replacing double quotes with escaped
double quotes. This ensures that all occurrences of backslashes and
double quotes are properly escaped.

- Modify the `value.replace` call to first escape backslashes and then
escape double quotes.
- The changes will be made in the `createFilterFromOptions` function,
specifically on line 128.

_Suggested fixes powered by Copilot Autofix. Review carefully before
merging._

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
(cherry picked from commit 7458ff1)

# Conflicts:
#	x-pack/plugins/observability_solution/infra/public/pages/metrics/metrics_explorer/components/helpers/create_tsvb_link.ts
smith added a commit to smith/kibana that referenced this pull request Oct 30, 2024
@smith
Fix code scanning alert no. 456: Incomplete string escaping or encodi…
dace68a 
…ng (elastic#193909)

Fixes
[https://github.com/elastic/kibana/security/code-scanning/456](https://github.com/elastic/kibana/security/code-scanning/456)

To fix the problem, we need to ensure that backslashes are also escaped
in the `value` string. This can be done by first replacing backslashes
with double backslashes and then replacing double quotes with escaped
double quotes. This ensures that all occurrences of backslashes and
double quotes are properly escaped.

- Modify the `value.replace` call to first escape backslashes and then
escape double quotes.
- The changes will be made in the `createFilterFromOptions` function,
specifically on line 128.

_Suggested fixes powered by Copilot Autofix. Review carefully before
merging._

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
(cherry picked from commit 7458ff1)

# Conflicts:
#	x-pack/plugins/observability_solution/infra/public/pages/metrics/metrics_explorer/components/helpers/create_tsvb_link.ts
@smith smith mentioned this pull request Oct 30, 2024
Merged
smith added a commit to smith/kibana that referenced this pull request Oct 30, 2024
@smith
Fix code scanning alert no. 456: Incomplete string escaping or encodi…
8f2e3d5 
…ng (elastic#193909)

Fixes
[https://github.com/elastic/kibana/security/code-scanning/456](https://github.com/elastic/kibana/security/code-scanning/456)

To fix the problem, we need to ensure that backslashes are also escaped
in the `value` string. This can be done by first replacing backslashes
with double backslashes and then replacing double quotes with escaped
double quotes. This ensures that all occurrences of backslashes and
double quotes are properly escaped.

- Modify the `value.replace` call to first escape backslashes and then
escape double quotes.
- The changes will be made in the `createFilterFromOptions` function,
specifically on line 128.

_Suggested fixes powered by Copilot Autofix. Review carefully before
merging._

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
(cherry picked from commit 7458ff1)

# Conflicts:
#	x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/helpers/create_tsvb_link.ts
@kibanamachine
Copy link
Contributor

Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync.

smith added a commit that referenced this pull request Oct 30, 2024
@smith
[8.x] Fix code scanning alert no. 456: Incomplete string escaping or …
bee1702 
…encoding (#193909) (#198241)

# Backport

This will backport the following commits from `main` to `8.x`:
- Fix code scanning alert no. 456: Incomplete string escaping or
encoding (#193909) (7458ff1)

<!--- Backport version: 8.9.8 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Nathan L
Smith","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-09-25T21:30:52Z","message":"Fix
code scanning alert no. 456: Incomplete string escaping or encoding
(#193909)\n\nFixes\r\n[https://github.com/elastic/kibana/security/code-scanning/456](https://github.com/elastic/kibana/security/code-scanning/456)\r\n\r\nTo
fix the problem, we need to ensure that backslashes are also
escaped\r\nin the `value` string. This can be done by first replacing
backslashes\r\nwith double backslashes and then replacing double quotes
with escaped\r\ndouble quotes. This ensures that all occurrences of
backslashes and\r\ndouble quotes are properly escaped.\r\n\r\n- Modify
the `value.replace` call to first escape backslashes and then\r\nescape
double quotes.\r\n- The changes will be made in the
`createFilterFromOptions` function,\r\nspecifically on line
128.\r\n\r\n\r\n_Suggested fixes powered by Copilot Autofix. Review
carefully before\r\nmerging._\r\n\r\nCo-authored-by: Copilot Autofix
powered by AI
<62310815+github-advanced-security[bot]@users.noreply.github.com>","sha":"7458ff11174fe184afe4ec93c858f89063296abe"},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[]}]
BACKPORT-->
smith added a commit that referenced this pull request Oct 31, 2024
@smith
[8.16] Fix code scanning alert no. 456: Incomplete string escaping or…
189cf8b 
… encoding (#193909) (#198242)

# Backport

This will backport the following commits from `main` to `8.16`:
- Fix code scanning alert no. 456: Incomplete string escaping or
encoding (#193909) (7458ff1)

<!--- Backport version: 8.9.8 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Nathan L
Smith","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-09-25T21:30:52Z","message":"Fix
code scanning alert no. 456: Incomplete string escaping or encoding
(#193909)\n\nFixes\r\n[https://github.com/elastic/kibana/security/code-scanning/456](https://github.com/elastic/kibana/security/code-scanning/456)\r\n\r\nTo
fix the problem, we need to ensure that backslashes are also
escaped\r\nin the `value` string. This can be done by first replacing
backslashes\r\nwith double backslashes and then replacing double quotes
with escaped\r\ndouble quotes. This ensures that all occurrences of
backslashes and\r\ndouble quotes are properly escaped.\r\n\r\n- Modify
the `value.replace` call to first escape backslashes and then\r\nescape
double quotes.\r\n- The changes will be made in the
`createFilterFromOptions` function,\r\nspecifically on line
128.\r\n\r\n\r\n_Suggested fixes powered by Copilot Autofix. Review
carefully before\r\nmerging._\r\n\r\nCo-authored-by: Copilot Autofix
powered by AI
<62310815+github-advanced-security[bot]@users.noreply.github.com>","sha":"7458ff11174fe184afe4ec93c858f89063296abe"},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[]}]
BACKPORT-->
smith added a commit that referenced this pull request Oct 31, 2024
@smith
[7.17] Fix code scanning alert no. 456: Incomplete string escaping or…
f459eba 
… encoding (#193909) (#198243)

# Backport

This will backport the following commits from `main` to `7.17`:
- Fix code scanning alert no. 456: Incomplete string escaping or
encoding (#193909) (7458ff1)

<!--- Backport version: 8.9.8 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Nathan L
Smith","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-09-25T21:30:52Z","message":"Fix
code scanning alert no. 456: Incomplete string escaping or encoding
(#193909)\n\nFixes\r\n[https://github.com/elastic/kibana/security/code-scanning/456](https://github.com/elastic/kibana/security/code-scanning/456)\r\n\r\nTo
fix the problem, we need to ensure that backslashes are also
escaped\r\nin the `value` string. This can be done by first replacing
backslashes\r\nwith double backslashes and then replacing double quotes
with escaped\r\ndouble quotes. This ensures that all occurrences of
backslashes and\r\ndouble quotes are properly escaped.\r\n\r\n- Modify
the `value.replace` call to first escape backslashes and then\r\nescape
double quotes.\r\n- The changes will be made in the
`createFilterFromOptions` function,\r\nspecifically on line
128.\r\n\r\n\r\n_Suggested fixes powered by Copilot Autofix. Review
carefully before\r\nmerging._\r\n\r\nCo-authored-by: Copilot Autofix
powered by AI
<62310815+github-advanced-security[bot]@users.noreply.github.com>","sha":"7458ff11174fe184afe4ec93c858f89063296abe"},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[]}]
BACKPORT-->
@kibanamachine kibanamachine removed the backport missing Added to PRs automatically when the are determined to be missing a backport. label Oct 31, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rmyz rmyz rmyz approved these changes

Assignees
No one assigned
Labels
backport:all-open Backport to all branches that could still receive a release ci:project-deploy-observability Create an Observability project release_note:fix v9.0.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@smith @obltmachine @kibana-ci @kibanamachine @rmyz