[alerting] encode rule/connector ids in http requests made from alerting UI #97854

pmuellr · 2021-04-21T16:52:44Z

resolves: #97852

Summary

Adds encodeURIComponent() wrappers around references to rule, alert, and connector ids. Without this fix, if an alert id (which can contain customer-generated data) contains a character that needs to be URL encoded, the resulting API call from the web UI will fail.

Checklist

Delete any items that are not applicable to this PR.

~~Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support~~
~~Documentation was added for features that require explanation or tutorials~~
Unit or functional tests were updated or added to match the most common scenarios
~~Any UI touched in this PR is usable by keyboard only (learn more about keyboard accessibility)~~
~~Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)~~
~~If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list~~
~~This renders correctly on smaller devices using a responsive layout. (You can test this in your browser)~~
~~This was checked for cross-browser compatibility~~

For maintainers

~~This was checked for breaking API changes and was labeled appropriately~~

…ing UI resolves: elastic#97852 Adds `encodeURIComponent()` wrappers around references to rule, alert, and connector ids. Without this fix, if an alert id (which can contain customer-generated data) contains a character that needs to be URL encoded, the resulting API call from the web UI will fail.

elasticmachine · 2021-04-22T02:53:32Z

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

YulNaumenko

LGTM

ymao1

LGTM!

pmuellr · 2021-04-22T21:20:18Z

@elasticmachine merge upstream

pmuellr · 2021-04-23T13:25:57Z

@elasticmachine merge upstream

pmuellr · 2021-04-23T17:14:09Z

@elasticmachine merge upstream

kibanamachine · 2021-04-23T19:11:12Z

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`triggersActionsUi`	1.5MB	1.5MB	+400.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`triggersActionsUi`	106.1KB	106.1KB	+60.0B

History

💔 Build #121896 failed 3414957
💛 Build #121565 was flaky 59b7be8
💚 Build #121475 succeeded 71f30e2
💚 Build #121455 succeeded e860ded

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

…ing UI (elastic#97854) resolves: elastic#97852 Adds `encodeURIComponent()` wrappers around references to rule, alert, and connector ids. Without this fix, if an alert id (which can contain customer-generated data) contains a character that needs to be URL encoded, the resulting API call from the web UI will fail.

pmuellr · 2021-04-23T19:54:43Z

Starting a backport for 7.13, after feature freeze this Tuesday, since this is a pretty nasty bug that was easy to fix. Going to attempt a 7.12 backport as well, but not hopeful due to the API naming changes we made in 7.13

…ing UI (elastic#97854) resolves: elastic#97852 Adds `encodeURIComponent()` wrappers around references to rule, alert, and connector ids. Without this fix, if an alert id (which can contain customer-generated data) contains a character that needs to be URL encoded, the resulting API call from the web UI will fail. # Conflicts: # x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/jira/api.test.ts # x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/jira/api.ts # x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/api.test.ts # x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/api.ts # x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/api.test.ts # x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/api.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/delete.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/delete.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/execute.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/execute.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/update.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/update.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/alert_summary.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/alert_summary.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/delete.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/delete.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/disable.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/disable.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/enable.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/enable.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/get_rule.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/get_rule.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/mute.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/mute.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/mute_alert.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/mute_alert.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/unmute.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/unmute.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/unmute_alert.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/unmute_alert.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/update.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/update.ts # x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts

pmuellr · 2021-04-23T20:54:31Z

Ya, the 7.12.2 backport will end up being a re-write of this PR from scratch, due to the API name changes and file name changes. Not clear it's worth it at this point. 7.12.2 is scheduled for May 18, 7.13.0 is scheduled for May 25.

…ing UI (#97854) (#98208) resolves: #97852 Adds `encodeURIComponent()` wrappers around references to rule, alert, and connector ids. Without this fix, if an alert id (which can contain customer-generated data) contains a character that needs to be URL encoded, the resulting API call from the web UI will fail.

…ing UI (#97854) (#98209) resolves: #97852 Adds `encodeURIComponent()` wrappers around references to rule, alert, and connector ids. Without this fix, if an alert id (which can contain customer-generated data) contains a character that needs to be URL encoded, the resulting API call from the web UI will fail.

…m alerting UI (#97854) (#98211) * [alerting] encode rule/connector ids in http requests made from alerting UI (#97854) resolves: #97852 Adds `encodeURIComponent()` wrappers around references to rule, alert, and connector ids. Without this fix, if an alert id (which can contain customer-generated data) contains a character that needs to be URL encoded, the resulting API call from the web UI will fail. # Conflicts: # x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/jira/api.test.ts # x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/jira/api.ts # x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/api.test.ts # x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/resilient/api.ts # x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/api.test.ts # x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/api.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/delete.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/delete.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/execute.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/execute.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/update.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/update.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/alert_summary.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/alert_summary.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/delete.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/delete.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/disable.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/disable.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/enable.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/enable.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/get_rule.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/get_rule.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/mute.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/mute.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/mute_alert.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/mute_alert.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/unmute.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/unmute.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/unmute_alert.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/unmute_alert.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/update.test.ts # x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api/update.ts # x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts * fix merge conflicts In 7.13.0, the structure of the connector and rules API libraries in triggers_actions_ui changed, where in 7.12 they were all in a single file - one for connectors, one for rules - but in 7.13 they are split out into separate files in a directory for connectors and one for rules. To cut down on the noise, I decided to not use the `encodeURIComponent()` wrappers on rule ids, just connector ids and alert ids, since it's not possible in 7.12 to have rule ids which are not UUIDs, and so don't need the encoding. * fix prettier errors Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

pmuellr · 2021-04-26T18:06:19Z

Went ahead and fixed the 7.12 backport, with some caveats: #98211 (comment) - this should ship in 7.12.2, so added that label.

…ing UI (elastic#97854) resolves: elastic#97852 Adds `encodeURIComponent()` wrappers around references to rule, alert, and connector ids. Without this fix, if an alert id (which can contain customer-generated data) contains a character that needs to be URL encoded, the resulting API call from the web UI will fail.

pmuellr added Feature:Alerting release_note:skip Skip the PR/issue when compiling release notes Feature:Actions Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) v7.13.0 labels Apr 21, 2021

add jest tests

71f30e2

spalger added v7.14.0 and removed v7.13.0 labels Apr 21, 2021

add function test

59b7be8

pmuellr marked this pull request as ready for review April 22, 2021 02:53

pmuellr requested a review from a team as a code owner April 22, 2021 02:53

YulNaumenko approved these changes Apr 22, 2021

View reviewed changes

ymao1 approved these changes Apr 22, 2021

View reviewed changes

Merge branch 'master' into alerting/encodeURIComponent

3414957

Merge branch 'master' into alerting/encodeURIComponent

aa4b480

Merge branch 'master' into alerting/encodeURIComponent

87403fe

pmuellr merged commit 2ebb308 into elastic:master Apr 23, 2021

pmuellr mentioned this pull request Apr 23, 2021

[7.x] [alerting] encode rule/connector ids in http requests made from alerting UI (#97854) #98208

Merged

pmuellr mentioned this pull request Apr 23, 2021

[7.13] [alerting] encode rule/connector ids in http requests made from alerting UI (#97854) #98209

Merged

pmuellr added the v7.13.0 label Apr 23, 2021

pmuellr mentioned this pull request Apr 23, 2021

[7.12] [alerting] encode rule/connector ids in http requests made from alerting UI (#97854) #98211

Merged

pmuellr added the v7.12.2 label Apr 26, 2021

pmuellr added the backported label Apr 26, 2021

pmuellr mentioned this pull request Apr 26, 2021

[alerting] document alerting ids that need URL encoding, and add encoded mustache vars for them #97747

Open

ymao1 mentioned this pull request May 26, 2021

Alert instance can't be muted when it contains a slash #100434

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[alerting] encode rule/connector ids in http requests made from alerting UI #97854

[alerting] encode rule/connector ids in http requests made from alerting UI #97854

pmuellr commented Apr 21, 2021 •

edited

Loading

elasticmachine commented Apr 22, 2021

YulNaumenko left a comment

ymao1 left a comment

pmuellr commented Apr 22, 2021

pmuellr commented Apr 23, 2021

pmuellr commented Apr 23, 2021

kibanamachine commented Apr 23, 2021

pmuellr commented Apr 23, 2021

pmuellr commented Apr 23, 2021

pmuellr commented Apr 26, 2021

[alerting] encode rule/connector ids in http requests made from alerting UI #97854

[alerting] encode rule/connector ids in http requests made from alerting UI #97854

Conversation

pmuellr commented Apr 21, 2021 • edited Loading

Summary

Checklist

For maintainers

elasticmachine commented Apr 22, 2021

YulNaumenko left a comment

Choose a reason for hiding this comment

ymao1 left a comment

Choose a reason for hiding this comment

pmuellr commented Apr 22, 2021

pmuellr commented Apr 23, 2021

pmuellr commented Apr 23, 2021

kibanamachine commented Apr 23, 2021

💚 Build Succeeded

Metrics [docs]

Async chunks

Page load bundle

History

pmuellr commented Apr 23, 2021

pmuellr commented Apr 23, 2021

pmuellr commented Apr 26, 2021

pmuellr commented Apr 21, 2021 •

edited

Loading