From e306b575efd640084c35389665aab3e5a648ca76 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Sat, 23 Nov 2024 12:54:42 +1100
Subject: [PATCH] [8.16] [Security Solution] Fix an error with nested fields
 being treated as keyword (#201473) (#201482)

# Backport

This will backport the following commits from `main` to `8.16`:
- [[Security Solution] Fix an error with nested fields being treated as
keyword (#201473)](https://github.com/elastic/kibana/pull/201473)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Kevin
Qualters","email":"56408403+kqualters-elastic@users.noreply.github.com"},"sourceCommit":{"committedDate":"2024-11-23T00:11:12Z","message":"[Security
Solution] Fix an error with nested fields being treated as keyword
(#201473)\n\n## Summary\r\nWhen formatting elasticsearch responses for
the frontend, the timelines\r\nsearch strategies will treat unmapped
fields as type: keyword. If the\r\nunderlying field is actually an
object, but is seen as a string in the\r\ncode, this for (key in source)
loop will fail, as it's trying to loop\r\nover a string. Fix below
should have minimal effect as the data is\r\naccessible at the further
nested keys.\r\n\r\n\r\n\r\n### Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"c6cb05996188ec7613d38f10de57dade356d12f7","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Threat
Hunting:Investigations","backport:prev-major"],"title":"[Security
Solution] Fix an error with nested fields being treated as
keyword","number":201473,"url":"https://github.com/elastic/kibana/pull/201473","mergeCommit":{"message":"[Security
Solution] Fix an error with nested fields being treated as keyword
(#201473)\n\n## Summary\r\nWhen formatting elasticsearch responses for
the frontend, the timelines\r\nsearch strategies will treat unmapped
fields as type: keyword. If the\r\nunderlying field is actually an
object, but is seen as a string in the\r\ncode, this for (key in source)
loop will fail, as it's trying to loop\r\nover a string. Fix below
should have minimal effect as the data is\r\naccessible at the further
nested keys.\r\n\r\n\r\n\r\n### Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"c6cb05996188ec7613d38f10de57dade356d12f7"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/201473","number":201473,"mergeCommit":{"message":"[Security
Solution] Fix an error with nested fields being treated as keyword
(#201473)\n\n## Summary\r\nWhen formatting elasticsearch responses for
the frontend, the timelines\r\nsearch strategies will treat unmapped
fields as type: keyword. If the\r\nunderlying field is actually an
object, but is seen as a string in the\r\ncode, this for (key in source)
loop will fail, as it's trying to loop\r\nover a string. Fix below
should have minimal effect as the data is\r\naccessible at the further
nested keys.\r\n\r\n\r\n\r\n### Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"c6cb05996188ec7613d38f10de57dade356d12f7"}}]}]
BACKPORT-->

Co-authored-by: Kevin Qualters <56408403+kqualters-elastic@users.noreply.github.com>
---
 .../timeline/factory/helpers/format_timeline_data.ts            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/helpers/format_timeline_data.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/helpers/format_timeline_data.ts
index 485ec64badd5c..481b74a802fec 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/helpers/format_timeline_data.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/helpers/format_timeline_data.ts
@@ -34,7 +34,7 @@ const createBaseTimelineEdges = (): TimelineEdges => ({
 
 function deepMerge(target: EventSource, source: EventSource) {
   for (const key in source) {
-    if (source[key] instanceof Object && key in target) {
+    if (source && source[key] instanceof Object && target && target[key] instanceof Object) {
       deepMerge(target[key], source[key]);
     } else {
       target[key] = source[key];