From f459eba59d83fb648235f053a187dda2b40de0f8 Mon Sep 17 00:00:00 2001
From: Nathan L Smith <nathan.smith@elastic.co>
Date: Thu, 31 Oct 2024 02:52:44 -0500
Subject: [PATCH] [7.17] Fix code scanning alert no. 456: Incomplete string
 escaping or encoding (#193909) (#198243)

# Backport

This will backport the following commits from `main` to `7.17`:
- Fix code scanning alert no. 456: Incomplete string escaping or
encoding (#193909) (7458ff11)

<!--- Backport version: 8.9.8 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Nathan L
Smith","email":"nathan.smith@elastic.co"},"sourceCommit":{"committedDate":"2024-09-25T21:30:52Z","message":"Fix
code scanning alert no. 456: Incomplete string escaping or encoding
(#193909)\n\nFixes\r\n[https://github.com/elastic/kibana/security/code-scanning/456](https://github.com/elastic/kibana/security/code-scanning/456)\r\n\r\nTo
fix the problem, we need to ensure that backslashes are also
escaped\r\nin the `value` string. This can be done by first replacing
backslashes\r\nwith double backslashes and then replacing double quotes
with escaped\r\ndouble quotes. This ensures that all occurrences of
backslashes and\r\ndouble quotes are properly escaped.\r\n\r\n- Modify
the `value.replace` call to first escape backslashes and then\r\nescape
double quotes.\r\n- The changes will be made in the
`createFilterFromOptions` function,\r\nspecifically on line
128.\r\n\r\n\r\n_Suggested fixes powered by Copilot Autofix. Review
carefully before\r\nmerging._\r\n\r\nCo-authored-by: Copilot Autofix
powered by AI
<62310815+github-advanced-security[bot]@users.noreply.github.com>","sha":"7458ff11174fe184afe4ec93c858f89063296abe"},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[]}]
BACKPORT-->
---
 .../metrics_explorer/components/helpers/create_tsvb_link.ts     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/helpers/create_tsvb_link.ts b/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/helpers/create_tsvb_link.ts
index 84d87ee4ad1b7..4c3551db3cbcd 100644
--- a/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/helpers/create_tsvb_link.ts
+++ b/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/helpers/create_tsvb_link.ts
@@ -125,7 +125,7 @@ export const createFilterFromOptions = (
             if (!value) {
               return null;
             }
-            return `${field}: "${value.replace('"', '\\"')}"`;
+            return `${field}: "${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
           })
           .join(' and ')
       : `${options.groupBy} : "${id}"`;