Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] Adapt special character escape according to kuery grammer #198288

Merged
merged 5 commits into from
Dec 3, 2024
Merged

[Security Solution] Adapt special character escape according to kuery grammer #198288

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9fb1723
fix: adapt special character replacement according to kuery.peg
logeekal Oct 30, 2024
0184821
fix: port escapeKuery from 8.16->7.17
logeekal Oct 30, 2024
c0b7a1b
replicate PR #128289
logeekal Nov 4, 2024
4dce7fa
Merge branch '7.17' into fix/code_scanning_alert_349
logeekal Nov 5, 2024
9a0a361
Merge branch '7.17' into fix/code_scanning_alert_349
logeekal Dec 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions x-pack/plugins/timelines/public/components/utils/keury/index.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,4 +62,28 @@ describe('Kuery escape', () => {
const expected = 'This\\nhas\\tnewlines\\r\\nwith\\ttabs';
expect(escapeKuery(value)).to.be(expected);
});

it('should escape backslashes', () => {
const value = 'This\\has\\backslashes';
const expected = 'This\\\\has\\\\backslashes';
expect(escapeKuery(value)).to.be(expected);
});

it('should escape multiple backslashes and quotes', () => {
const value = 'This\\ has 2" quotes & \\ 2 "backslashes';
const expected = 'This\\\\ has 2\\" quotes & \\\\ 2 \\"backslashes';
expect(escapeKuery(value)).to.be(expected);
});

it('should escape all special character according to kuery.peg SpecialCharacter rule', () => {
/*
* Ref: packages/kbn-es-query/grammar/grammar.peggy
*
* SpecialCharacter
* = [\\():<>"*{}]
*/
const value = `\\():"*{}`;
const expected = `\\\\\\(\\)\\:\\"\\*\\{\\}`;
expect(escapeKuery(value)).to.be(expected);
logeekal marked this conversation as resolved.
Show resolved Hide resolved
});
});
2 changes: 1 addition & 1 deletion x-pack/plugins/timelines/public/components/utils/keury/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ const escapeWhitespace = (val: string) =>
val.replace(/\t/g, '\\t').replace(/\r/g, '\\r').replace(/\n/g, '\\n');

// See the SpecialCharacter rule in kuery.peg
const escapeSpecialCharacters = (val: string) => val.replace(/["]/g, '\\$&'); // $& means the whole matched string
const escapeSpecialCharacters = (val: string) => val.replace(/["\\\(\)\:\<\>\*\{\}]/g, '\\$&'); // $& means the whole matched string

// See the Keyword rule in kuery.peg
// I do not think that we need that anymore since we are doing a full match_phrase all the time now => return `"${escapeKuery(val)}"`;
Expand Down