Hide input value from kbn-config-schema error messages #58843

pgayvallet · 2020-02-28T08:13:37Z

Summary

Note: first commit converts every config-schema's snapshots to inline snapshots (that needed to be done and greatly improve next commit's readability). Would be easier to review by ignoring it.

Checklist

Unit or functional tests were updated or added to match the most common scenarios

For maintainers

This was checked for breaking API changes and was labeled appropriately

elasticmachine · 2020-02-28T09:00:40Z

Pinging @elastic/kibana-platform (Team:Platform)

mikecote

Alerting changes LGTM

…nfig-schema-value-in-error

mshustov · 2020-03-02T13:52:07Z

packages/kbn-config-schema/src/types/map_of_type.test.ts

@@ -40,7 +40,7 @@ test('properly parse the value if input is a string', () => {
 test('fails if string input cannot be parsed', () => {
  const type = schema.mapOf(schema.string(), schema.string());
  expect(() => type.validate(`invalidjson`)).toThrowErrorMatchingInlineSnapshot(
-    `"could not parse map value from [invalidjson]"`


This example and schema.literal, hostname/uri bother me the most. It's would be painful to debug such a message without a real output and could make life harder for our support team. There are just a few fields in the config that could be considered as sensitive, and most of them are defined within the platform. OTOH it's a good practice to have the most strict rules and loosen them by request, so OK for me

I agree and I expressed the same concerns in #58652 (comment). But I guess being consistent in this rule makes the more sense.

Added this issue to today's weekly discussions just to be sure we all are on the same page here.

kobelb

Thanks for taking this on @pgayvallet!

It looks like ByteSizeValue and Duration are throwing errors with user input, and this can end up within the logs. The likelihood of us having sensitive/secret durations and byte sizes is pretty low, but in an effort to keep all of this consistent, something we should probably address. Were these intentionally excluded?

…nfig-schema-value-in-error

pgayvallet · 2020-03-03T07:47:17Z

@kobelb These were just overlooked. Fixed in d93bd87

kobelb · 2020-03-03T14:58:50Z

I think there's one more within ByteSizeValue

kibana/packages/kbn-config-schema/src/byte_size_value/index.ts

Line 41 in c81e0da

    
           `Failed to parse [${text}] as byte value. Value must be either number of bytes, or follow the format <count>[b|kb|mb|gb] ` +

…nfig-schema-value-in-error

pgayvallet · 2020-03-04T09:23:25Z

@kobelb hope that was the last one 😄 . PTAL

…nfig-schema-value-in-error

kibanamachine · 2020-03-06T14:14:25Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 37e5ebb

History

💛 Build #31379 was flaky d72f63f
💔 Build #31352 failed 48bed22
💚 Build #30666 succeeded 0905193
💚 Build #30280 succeeded d93bd87
💔 Build #29968 failed d361fd6

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* use inline snapshots instead of snapshots * hide input value from error messages * update core snapshots * update xpack snapshots * fix ftr assertions * fix new snapshots * hide values for byte_size and duration * update new snapshots * remove another byte_size value reference * fix yet another value references in error messages * update xpack snapshots * update xpack ftr assertions

kibanamachine · 2020-03-07T16:48:44Z

Looks like this PR has a backport PR but it still hasn't been merged. Please merge it ASAP to keep the branches relatively in sync.

…#59565) * Hide input value from kbn-config-schema error messages (#58843) * use inline snapshots instead of snapshots * hide input value from error messages * update core snapshots * update xpack snapshots * fix ftr assertions * fix new snapshots * hide values for byte_size and duration * update new snapshots * remove another byte_size value reference * fix yet another value references in error messages * update xpack snapshots * update xpack ftr assertions * update snapshots

* master: (154 commits) Add an optional authentication mode for HTTP resources (elastic#58589) Implement embeddable drilldown menu options (elastic#59232) [Alerting] "Create alert" graph visualization design improvements (elastic#59399) Alerting update route throttle property is missing (elastic#59580) [SIEM] Adds 'Load prebuilt rules' Cypress test (elastic#59529) Show error if field is not found during filter rendering (elastic#59298) Navigate back to discover app during test, because the saved search from the preceding test has major performance problems when used with this test (elastic#59571) Check for alert dialog when doing a force logout (elastic#59329) ensure fs deletes are not cwd dependent (elastic#59570) Empty message for APM service map (elastic#59518) [Drilldowns] <ActionWizard/> Component (elastic#59032) [Reporting] Improve the page exit error messages (elastic#59351) Ensure logged out starting state for tests that need it (elastic#59322) Hide input value from kbn-config-schema error messages (elastic#58843) [ML] Transforms: Migrate client plugin to NP. (elastic#59443) [ML] Disable failing functional tests [SIEM] Update Timeline to use the latest euiFlyoutBody style (elastic#59524) Temporarily remove the project mappings for PR labels (elastic#59493) [Alerting] replace index threshold graph usage of watcher APIs with new API (elastic#59385) [ML] Show view series link in anomalies table for machine_learning_user role (elastic#59549) ...

* use inline snapshots instead of snapshots * hide input value from error messages * update core snapshots * update xpack snapshots * fix ftr assertions * fix new snapshots * hide values for byte_size and duration * update new snapshots * remove another byte_size value reference * fix yet another value references in error messages * update xpack snapshots * update xpack ftr assertions

pgayvallet added 4 commits February 28, 2020 09:08

use inline snapshots instead of snapshots

0a87885

hide input value from error messages

7b5cdab

update core snapshots

5fe1155

update xpack snapshots

d6c35be

pgayvallet added Feature:New Platform Team:Core Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc v7.7.0 v8.0.0 labels Feb 28, 2020

pgayvallet marked this pull request as ready for review February 28, 2020 09:00

pgayvallet requested review from a team as code owners February 28, 2020 09:00

pgayvallet added the release_note:skip Skip the PR/issue when compiling release notes label Feb 28, 2020

fix ftr assertions

5e15e8c

mikecote approved these changes Feb 28, 2020

View reviewed changes

Merge remote-tracking branch 'upstream/master' into kbn-58652-hide-co…

d361fd6

…nfig-schema-value-in-error

mshustov approved these changes Mar 2, 2020

View reviewed changes

kobelb reviewed Mar 2, 2020

View reviewed changes

pgayvallet added 3 commits March 3, 2020 08:22

Merge remote-tracking branch 'upstream/master' into kbn-58652-hide-co…

7d1aa3e

…nfig-schema-value-in-error

fix new snapshots

d4b6c88

hide values for byte_size and duration

d93bd87

pgayvallet added 3 commits March 4, 2020 10:18

Merge remote-tracking branch 'upstream/master' into kbn-58652-hide-co…

334b043

…nfig-schema-value-in-error

update new snapshots

981a62a

remove another byte_size value reference

0905193

kobelb approved these changes Mar 5, 2020

View reviewed changes

pgayvallet added 6 commits March 6, 2020 09:33

Merge remote-tracking branch 'upstream/master' into kbn-58652-hide-co…

a41ba7a

…nfig-schema-value-in-error

fix yet another value references in error messages

48bed22

update xpack snapshots

b48e844

update xpack ftr assertions

70a1481

Merge remote-tracking branch 'upstream/master' into kbn-58652-hide-co…

d72f63f

…nfig-schema-value-in-error

Merge remote-tracking branch 'upstream/master' into kbn-58652-hide-co…

37e5ebb

…nfig-schema-value-in-error

pgayvallet merged commit 45fb6f3 into elastic:master Mar 6, 2020

pgayvallet mentioned this pull request Mar 6, 2020

[7.x] Hide input value from kbn-config-schema error messages (#58843) #59565

Merged

kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label Mar 7, 2020

kibanamachine removed the backport missing Added to PRs automatically when the are determined to be missing a backport. label Mar 8, 2020

mshustov mentioned this pull request Aug 29, 2020

ensure strings validated with config-schema do not leak in error messages #43617

Closed

mshustov mentioned this pull request Sep 29, 2020

@kbn/config-schema is slow #78351

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Hide input value from kbn-config-schema error messages #58843

Hide input value from kbn-config-schema error messages #58843

pgayvallet commented Feb 28, 2020 •

edited

Loading

elasticmachine commented Feb 28, 2020

mikecote left a comment

mshustov Mar 2, 2020

pgayvallet Mar 3, 2020

pgayvallet Mar 3, 2020

kobelb left a comment

pgayvallet commented Mar 3, 2020

kobelb commented Mar 3, 2020

pgayvallet commented Mar 4, 2020

kibanamachine commented Mar 6, 2020

kibanamachine commented Mar 7, 2020

Hide input value from kbn-config-schema error messages #58843

Hide input value from kbn-config-schema error messages #58843

Conversation

pgayvallet commented Feb 28, 2020 • edited Loading

Summary

Checklist

For maintainers

elasticmachine commented Feb 28, 2020

mikecote left a comment

Choose a reason for hiding this comment

mshustov Mar 2, 2020

Choose a reason for hiding this comment

pgayvallet Mar 3, 2020

Choose a reason for hiding this comment

pgayvallet Mar 3, 2020

Choose a reason for hiding this comment

kobelb left a comment

Choose a reason for hiding this comment

pgayvallet commented Mar 3, 2020

kobelb commented Mar 3, 2020

pgayvallet commented Mar 4, 2020

kibanamachine commented Mar 6, 2020

💚 Build Succeeded

History

kibanamachine commented Mar 7, 2020

pgayvallet commented Feb 28, 2020 •

edited

Loading