Disable allowAbsoluteUrls for axios (#215138)

## Summary
After https://github.com/elastic/kibana/pull/214843, `axios` client
usages need to set a flag to prevent the vulnerable behavior.

To reviewers: if you think it's a mistake, and you created a client to
request for absolute URLs, consider unsetting the `baseURL` to
communicate intent.

packages/kbn-ci-stats-performance-metrics/src/apm_client.ts

@@ -54,6 +54,7 @@ export class ApmClient {
       auth,
       baseURL,
       timeout,
+      allowAbsoluteUrls: false,
     });
 
     this.logger = logger || console;

packages/kbn-failed-test-reporter-cli/failed_tests_reporter/existing_failed_test_issues.test.ts

@@ -102,6 +102,7 @@ it('captures a list of failed test issue, loads the bodies for each issue, and o
       "calls": Array [
         Array [
           Object {
+            "allowAbsoluteUrls": false,
             "baseURL": "https://ci-stats.kibana.dev",
             "data": Object {
               "failures": Array [
@@ -117,6 +118,7 @@ it('captures a list of failed test issue, loads the bodies for each issue, and o
         ],
         Array [
           Object {
+            "allowAbsoluteUrls": false,
             "baseURL": "https://ci-stats.kibana.dev",
             "data": Object {
               "failures": Array [

packages/kbn-failed-test-reporter-cli/failed_tests_reporter/existing_failed_test_issues.ts

@@ -119,6 +119,7 @@ export class ExistingFailedTestIssues {
         const resp = await Axios.request<FindFailedTestIssuesResponse>({
           method: 'POST',
           baseURL: BASE_URL,
+          allowAbsoluteUrls: false,
           url: '/v1/find_failed_test_issues',
           data: {
             failures: failures.map((f) => ({

src/dev/prs/github_api.ts

@@ -29,6 +29,7 @@ export class GithubApi {
   constructor(private accessToken?: string) {
     this.api = axios.create({
       baseURL: 'https://api.github.com/',
+      allowAbsoluteUrls: false,
       headers: {
         Accept: 'application/vnd.github.v3+json',
         'User-Agent': 'kibana/update_prs_cli',

src/platform/packages/private/kbn-ci-stats-reporter/src/ci_stats_reporter.ts

@@ -372,6 +372,7 @@ export class CiStatsReporter {
           method: 'POST',
           url: path,
           baseURL: BASE_URL,
+          allowAbsoluteUrls: false,
           headers,
           data: body,
           params: query,

x-pack/platform/plugins/shared/actions/server/lib/axios_utils.test.ts

@@ -405,6 +405,7 @@ describe('request', () => {
           defaults: {
             ...axios.defaults,
             baseURL: 'https://here-we-go.com',
+            allowAbsoluteUrls: false,
           },
         } as unknown as AxiosInstance,
         url: '/test',

x-pack/platform/plugins/shared/dataset_quality/server/test_helpers/create_dataset_quality_users/helpers/call_kibana.ts

@@ -23,6 +23,7 @@ export async function callKibana<T>({
   const { data } = await axios.request({
     ...options,
     baseURL: baseUrl,
+    allowAbsoluteUrls: false,
     auth: { username, password },
     headers: { 'kbn-xsrf': 'true', 'x-elastic-internal-origin': 'kibana', ...options.headers },
   });

x-pack/solutions/observability/plugins/apm/scripts/diagnostics_bundle/diagnostics_bundle.ts

@@ -53,6 +53,7 @@ export async function initDiagnosticsBundle({
 
   const kibanaClientOpts = {
     baseURL: kbHost ?? parsedCloudId.kibanaHost,
+    allowAbsoluteUrls: false,
     auth,
     headers: {
       'kbn-xsrf': 'true',

x-pack/solutions/observability/plugins/apm/server/test_helpers/create_apm_users/helpers/call_kibana.ts

@@ -27,6 +27,7 @@ export async function callKibana<T>({
   const { data } = await axios.request({
     ...options,
     baseURL: baseUrl,
+    allowAbsoluteUrls: false,
     auth: { username, password },
     headers: { ...DEFAULT_HEADERS, ...options.headers },
   });

x-pack/solutions/observability/plugins/observability_onboarding/server/test_helpers/create_observability_onboarding_users/helpers/call_kibana.ts

@@ -23,6 +23,7 @@ export async function callKibana<T>({
   const { data } = await axios.request({
     ...options,
     baseURL: baseUrl,
+    allowAbsoluteUrls: false,
     auth: { username, password },
     headers: { 'kbn-xsrf': 'true', 'x-elastic-internal-origin': 'kibana', ...options.headers },
   });

x-pack/test/common/services/spaces.ts

@@ -48,6 +48,7 @@ export function SpacesServiceProvider({ getService }: FtrProviderContext) {
       'kbn-xsrf': 'x-pack/ftr/services/spaces/space',
     },
     baseURL: url,
+    allowAbsoluteUrls: false,
     maxRedirects: 0,
     validateStatus: () => true, // we do our own validation below and throw better error messages
     httpsAgent,

x-pack/test/profiling_api_integration/common/create_profiling_users/helpers/call_kibana.ts

@@ -23,6 +23,7 @@ export async function callKibana<T>({
   const { data } = await axios.request({
     ...options,
     baseURL: baseUrl,
+    allowAbsoluteUrls: false,
     auth: { username, password },
     headers: { 'kbn-xsrf': 'true', ...options.headers },
   });

x-pack/test/ui_capabilities/common/services/features.ts

@@ -19,6 +19,7 @@ export class FeaturesService {
     this.axios = axios.create({
       headers: { 'kbn-xsrf': 'x-pack/ftr/services/features' },
       baseURL: url,
+      allowAbsoluteUrls: false,
       maxRedirects: 0,
       validateStatus: () => true, // we'll handle our own statusCodes and throw informative errors
     });

x-pack/test/ui_capabilities/common/services/ui_capabilities.ts

@@ -39,6 +39,7 @@ export class UICapabilitiesService {
     this.axios = axios.create({
       headers: { 'kbn-xsrf': 'x-pack/ftr/services/ui_capabilities' },
       baseURL: url,
+      allowAbsoluteUrls: false,
       maxRedirects: 0,
       validateStatus: () => true, // we'll handle our own statusCodes and throw informative errors
     });