github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 09:48:58 -04:00
Code Issues Projects Releases Packages Wiki Activity

Sanitize workpad before sending to API (#57704) (#58241)

Browse source 
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
This commit is contained in:
Corey Robertson 2020-02-21 15:51:34 -05:00 • committed by GitHub
parent 952589d7f0
commit 5ccc0b62c4
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 35 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

38
x-pack/legacy/plugins/canvas/public/lib/workpad_service.js
View file

@ -12,6 +12,35 @@ import {
} from '../../common/lib/constants';
import { fetch } from '../../common/lib/fetch';
import { getCoreStart } from '../legacy';
/*
Remove any top level keys from the workpad which will be rejected by validation
*/
const validKeys = [
'@created',
'@timestamp',
'assets',
'colors',
'css',
'height',
'id',
'isWriteable',
'name',
'page',
'pages',
'width',
];
const sanitizeWorkpad = function(workpad) {
const workpadKeys = Object.keys(workpad);
for (const key of workpadKeys) {
if (!validKeys.includes(key)) {
delete workpad[key];
}
}
return workpad;
};
const getApiPath = function() {
const basePath = getCoreStart().http.basePath.get();
@ -29,7 +58,10 @@ const getApiPathAssets = function() {
};
export function create(workpad) {
return fetch.post(getApiPath(), { ...workpad, assets: workpad.assets || {} });
return fetch.post(getApiPath(), {
...sanitizeWorkpad({ ...workpad }),
assets: workpad.assets || {},
});
}
export function get(workpadId) {
@ -41,11 +73,11 @@ export function get(workpadId) {
// TODO: I think this function is never used. Look into and remove the corresponding route as well
export function update(id, workpad) {
return fetch.put(`${getApiPath()}/${id}`, workpad);
return fetch.put(`${getApiPath()}/${id}`, sanitizeWorkpad({ ...workpad }));
}
export function updateWorkpad(id, workpad) {
return fetch.put(`${getApiPathStructures()}/${id}`, workpad);
return fetch.put(`${getApiPathStructures()}/${id}`, sanitizeWorkpad({ ...workpad }));
}
export function updateAssets(id, workpadAssets) {