Enable prototype pollution protection in TSVB

docs/development/core/server/kibana-plugin-core-server.validateobject.md

@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [validateObject](./kibana-plugin-core-server.validateobject.md)
+
+## validateObject() function
+
+<b>Signature:</b>
+
+```typescript
+export declare function validateObject(obj: any): void;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  obj | <code>any</code> |  |
+
+<b>Returns:</b>
+
+`void`
+

src/core/server/http/index.ts

@@ -94,3 +94,4 @@ export {
 } from './cookie_session_storage';
 export * from './types';
 export { BasePath, IBasePath } from './base_path_service';
+export { validateObject } from './prototype_pollution';

src/core/server/index.ts

@@ -201,6 +201,7 @@ export {
   RouteConfigOptionsBody,
   RouteContentType,
   validBodyOutput,
+  validateObject,
   RouteValidatorConfig,
   RouteValidationSpec,
   RouteValidationFunction,

src/core/server/server.api.md

@@ -2985,6 +2985,11 @@ export interface UserProvidedValues<T = any> {
     userValue?: T;
 }
 
+// Warning: (ae-missing-release-tag) "validateObject" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export function validateObject(obj: any): void;
+
 // @public
 export const validBodyOutput: readonly ["data", "stream"];
 

src/plugins/vis_type_timeseries/server/routes/vis.ts

@@ -24,6 +24,7 @@ import { visPayloadSchema } from '../../common/vis_schema';
 import { ROUTES } from '../../common/constants';
 import { ValidationTelemetryServiceSetup } from '../index';
 import { Framework } from '../plugin';
+import { validateObject } from '../../../../core/server';
 
 const escapeHatch = schema.object({}, { unknowns: 'allow' });
 
@@ -41,6 +42,7 @@ export const visDataRoutes = (
     },
     async (requestContext, request, response) => {
       try {
+        validateObject(request.body);
         visPayloadSchema.validate(request.body);
       } catch (error) {
         logFailedValidation();