Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Saved Object] No validations when create/import saved_objects with special characters #119110

Closed
wwang500 opened this issue Nov 18, 2021 · 3 comments
Labels
bug Fixes for quality problems that affect the customer experience Feature:Saved Objects Team:Core Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc

Comments

@wwang500
Copy link

Kibana version:

7.16.0 BC5

Describe the bug:

When creating or importing custom saved objects (i.e. index patterns) with special chars into kibana, there is currently no validation in place.

The consequences are:

  • The detailed page of the save_object (index pattern) might be blank,
  • Machine learning Anomaly Detection and Data Frame analytic pages might be blank,
  • There might be more places as well.

Steps to reproduce:

  1. Save the below text to a .ndjson file,
{"attributes":{"fieldAttrs":"{}","fields":"[]","runtimeFieldMap":"any?\nSet-cookie: Tamper=5b4764ff-65e5-48f3-af8f-ed5f6a2f9c77","title":"cloned","typeMeta":"{}"},"coreMigrationVersion":"7.16.0","id":"00100950-4766-11ec-acb2-950edb4e669a","migrationVersion":{"index-pattern":"7.11.0"},"references":[],"sort":[1637126395502,2131],"type":"index-pattern","updated_at":"2021-11-17T05:19:55.502Z","version":"WzI2MDU0LDFd"}
{"attributes":{"fieldAttrs":"{}","fields":"\";print(chr(122).chr(97).chr(112).chr(95).chr(116).chr(111).chr(107).chr(101).chr(110));$var=\"","runtimeFieldMap":"{}","title":"cloned","typeMeta":"{}"},"coreMigrationVersion":"7.16.0","id":"006021f0-4762-11ec-acb2-950edb4e669a","migrationVersion":{"index-pattern":"7.11.0"},"references":[],"sort":[1637124678082,1284],"type":"index-pattern","updated_at":"2021-11-17T04:51:18.082Z","version":"WzE1MDE5LDFd"}
{"attributes":{"fieldAttrs":"{}","fields":"[]","runtimeFieldMap":"any\r\nSet-cookie: Tamper=5b4764ff-65e5-48f3-af8f-ed5f6a2f9c77\r\n","title":"cloned","typeMeta":"{}"},"coreMigrationVersion":"7.16.0","id":"00ab37e0-4766-11ec-acb2-950edb4e669a","migrationVersion":{"index-pattern":"7.11.0"},"references":[],"sort":[1637126396515,2130],"type":"index-pattern","updated_at":"2021-11-17T05:19:56.515Z","version":"WzI2MDU2LDFd"}
{"attributes":{"fieldAttrs":"{}","fields":"';print(chr(122).chr(97).chr(112).chr(95).chr(116).chr(111).chr(107).chr(101).chr(110));$var='","runtimeFieldMap":"{}","title":"cloned","typeMeta":"{}"},"coreMigrationVersion":"7.16.0","id":"00db4560-4762-11ec-acb2-950edb4e669a","migrationVersion":{"index-pattern":"7.11.0"},"references":[],"sort":[1637124678867,1287],"type":"index-pattern","updated_at":"2021-11-17T04:51:18.867Z","version":"WzE1MDMwLDFd"}
{"attributes":{"fieldAttrs":"{}","fields":"[]","runtimeFieldMap":"any?\r\nSet-cookie: Tamper=5b4764ff-65e5-48f3-af8f-ed5f6a2f9c77\r\n","title":"cloned","typeMeta":"{}"},"coreMigrationVersion":"7.16.0","id":"01481420-4766-11ec-acb2-950edb4e669a","migrationVersion":{"index-pattern":"7.11.0"},"references":[],"sort":[1637126397543,2129],"type":"index-pattern","updated_at":"2021-11-17T05:19:57.543Z","version":"WzI2MDY3LDFd"}
{"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":614,"missingRefCount":0,"missingReferences":[]}
  1. Import the .ndjson file through app/management/kibana/objects page,
  2. After import, click any imported saved object, it will show blank saved_object page

Screen Shot 2021-11-18 at 4 19 55 PM

  1. Go to Index Pattern page, click any imported object, it will show blank page
  2. Go to Machine Learning -> Anomaly Detection or Machine Learning -> Data Frame Analytic page, it will show blank page

Expected behavior:

Either it should have some validation for the special chars, or those blank page should throw valid errors and still be function-able.

@wwang500 wwang500 added bug Fixes for quality problems that affect the customer experience Team:Core Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc Feature:Saved Objects labels Nov 18, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-core (Team:Core)

@pgayvallet
Copy link
Contributor

Will be addressed by the initiative started with #104088

@afharo
Copy link
Member

afharo commented Jul 19, 2022

Resolved by #104088

@afharo afharo closed this as completed Jul 19, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience Feature:Saved Objects Team:Core Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc
Projects
None yet
Development

No branches or pull requests

4 participants