Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable prototype pollution protection in TSVB #85952

Merged
merged 17 commits into from
Dec 31, 2020
Merged

Enable prototype pollution protection in TSVB #85952

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
2724105
Enable prototype pollution protection in TSVB
DianaDerevyankina Dec 15, 2020
8f12f42
Merge branch 'master' into Diana/78908
kibanamachine Dec 15, 2020
389eb9c
Merge branch 'master' into Diana/78908
DianaDerevyankina Dec 15, 2020
9b74da8
Merge branch 'master' into Diana/78908
DianaDerevyankina Dec 16, 2020
631bd57
Update Dock API Changes
DianaDerevyankina Dec 16, 2020
01711fd
Merge branch 'master' into Diana/78908
kibanamachine Dec 16, 2020
0e2ce95
Merge branch 'master' into Diana/78908
DianaDerevyankina Dec 17, 2020
e773319
Merge branch 'Diana/78908' of https://github.com/DianaDerevyankina/ki…
DianaDerevyankina Dec 17, 2020
679417c
Replace logging failed in validateObject validation with 400 error
DianaDerevyankina Dec 17, 2020
82cff88
Merge branch 'master' into Diana/78908
DianaDerevyankina Dec 18, 2020
0555f02
Move validateObject to kbn-std package and add a description
DianaDerevyankina Dec 18, 2020
4160164
Merge branch 'master' into Diana/78908
DianaDerevyankina Dec 18, 2020
7b9aff0
Update Doc API Changes
DianaDerevyankina Dec 18, 2020
b9185ee
Merge branch 'master' into Diana/78908
DianaDerevyankina Dec 21, 2020
4261fbe
Rename validateObject function to ensureNoUnsafeProperties
DianaDerevyankina Dec 21, 2020
8f1f8a9
Rename other validateObject occurrences
DianaDerevyankina Dec 21, 2020
59a0e40
Merge branch 'master' into Diana/78908
kibanamachine Dec 30, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/core/server/http/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,3 +94,4 @@ export {
} from './cookie_session_storage';
export * from './types';
export { BasePath, IBasePath } from './base_path_service';
export { validateObject } from './prototype_pollution';
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would really like to avoid static functions leaking outside of core. If this needs to be used in plugins, maybe moving it to a package (existing or new) would make sense. wdyt @legrego?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not opposed to moving this into a package. That'd certainly make it easier to consume

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dziyanadzeraviankina we are currently discussing the details with @legrego. Note that if it's mandatory to have this merged for 7.11, we could do the moving/refactoring at a later time. So considerer this approved on my side if this is urgent.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure if there's a suitable package for that, maybe it could be moved to kbn-config-schema package, or is it better to create a new one?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would @kbn/std work for this?

1 change: 1 addition & 0 deletions src/core/server/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,6 +201,7 @@ export {
RouteConfigOptionsBody,
RouteContentType,
validBodyOutput,
validateObject,
RouteValidatorConfig,
RouteValidationSpec,
RouteValidationFunction,
Expand Down
2 changes: 2 additions & 0 deletions src/plugins/vis_type_timeseries/server/routes/vis.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ import { visPayloadSchema } from '../../common/vis_schema';
import { ROUTES } from '../../common/constants';
import { ValidationTelemetryServiceSetup } from '../index';
import { Framework } from '../plugin';
import { validateObject } from '../../../../core/server';

const escapeHatch = schema.object({}, { unknowns: 'allow' });

Expand All @@ -41,6 +42,7 @@ export const visDataRoutes = (
},
async (requestContext, request, response) => {
try {
validateObject(request.body);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@flash1293 could you please confirm that it's exactly is what you described in #78908.

Honestly I don't fully understand why we need it cause I've tried to add __proto__, prototype properties into payload and got the following error: "Invalid request payload JSON format"
Just want to be double sure that we really need it

visPayloadSchema.validate(request.body);
} catch (error) {
logFailedValidation();
Expand Down