## Summary
1. Extends the server-side prototype pollution protections introduced in
https://github.com/elastic/kibana/pull/190716 to include
`Array.prototype`.
2. Applies the same prototype pollution protections to the client-side.
### Identify risks
Does this PR introduce any risks? For example, consider risks like hard
to test bugs, performance regression, potential of data loss.
Describe the risk, its severity, and mitigation for each identified
risk. Invite stakeholders and evaluate how to proceed before merging.
- [ ] Sealing prototypes on the client can lead to failures in
third-party dependencies. I'm relying on sufficient functional test
coverage to detect issues here. As a result, these protections are
disabled by default for now, and can be controlled via setting
`server.prototypeHardening: true/false`
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
## Summary
Moving common services to respective new homes.
Resolves: https://github.com/elastic/kibana/issues/188541
---------
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
This change ensures that the `unsafe-eval` source expression isn't included in
the Kibana Content Security Policy (CSP) by default.
Users can set `csp.disableUnsafeEval: false` to reintroduce `unsafe-eval`.
However, since this config option is deprecated as of this commit, it's
recommended to instead set `csp.script_src: ['unsafe-eval']`.
Closes#150156
The location of plugins was previously somewhat irrelevant, but as we
move into packages it's more important that we can find all plugins in
the repository, and we would like to be able to do that without needing
to maintain a manifest somewhere to accomplish this. In order to make
this possible we plan to find any plugin/package by spotting all
kibana.json files which are not "fixtures". This allows plugin-like code
(but not actual plugin code) to exist for testing purposes, but it must
be within some form of "fixtures" directory, and any plugin that isn't
in a fixtures directory will be automatically pulled into the system
(though test plugins, examples, etc. will still only be loaded when the
plugin's path is passed via `--plugin-path`, the system will know about
them and use that knowledge for other things).
Since this is just a rename Operations will review and merge by EOD Jan
12th unless someone has a blocking concern.
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Adds a new experimental Kibana setting called `csp.disableUnsafeEval` which will default to `false`. When set to `true`, it will remove `unsafe-eval` from our CSP.
Also introduces a new module called `@kbn/handlebars` which is a replacement for the official `handlebars` module used in the frontend. This new module is necessary in order to avoid calling `eval`/`new Function` from within `handlebars` which is not allowed once `unsafe-eval` is removed from our CSP.
The `@kbn/handlebars` module is simply an extension of the main `handlebars` module which adds a new compile function called `compileAST` (as an alternative to the regular `compile` function). This new function will not use code-generation from strings to compile the template but will instead generate an AST and return a render function with the same API as the function returned by the regular `compile` function.
This is a little bit slower method, but since this is only meant to be used client-side, the slowdown should not be an issue.
The following limitations exists when using `@kbn/handlebars`:
The Inline partials handlebars template feature is not supported.
Only the following compile options will be supported:
- `knownHelpers`
- `knownHelpersOnly`
- `strict`
- `assumeObjects`
- `noEscape`
- `data`
Only the following runtime options will be supported:
- `helpers`
- `blockParams`
- `data`
Closes#36311
* First stab at surfacing deprecations from warning header
* Log deprecations with error level but disable logger context by default
* Don't filter out error logs from ProcRunner
* Another try at not having messages ignored on CI
* Log deprecation logs with warn not info
* Tests
* Let write() do it's writing
* Commit pre-built @kbn/pm package
* Second try to commit pre-built @kbn/pm package
* Enable deprecation logger for jest_integration even though logs aren't interleaved
* Apply suggestions from code review
Co-authored-by: Luke Elmers <lukeelmers@gmail.com>
* deprecations logger: warn for kibana and debug for users
* Refactor split query and deprecation logger out of configure_client
* Unit test for tooling_log_text_writer
* Fix TS
* Use event.meta.request.params.headers to include Client constructor headers
* Fix tests
* Ignore deprecation warnings not from Elasticsearch
* Log on info level
* Log in JSON so that entire deprecation message is on one line
* commit built kbn-pm package
Co-authored-by: Luke Elmers <lukeelmers@gmail.com>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* remove kbn-legacy-logging package
* remove legacy service
* remove legacy appender
* remove LegacyObjectToConfigAdapter
* gix types
* remove @hapi/good / @hapi/good-squeeze / @hapi/podium
* remove `default` appender validation for `root` logger
* remove old config key from kibana-docker
* fix FTR config
* fix dev server
* remove reference from readme
* fix unit test
* clean CLI args and remove quiet option
* fix type
* fix status test config
* remove from test config
* fix snapshot
* use another regexp
* update generated doc
* fix createRootWithSettings
* fix some integration tests
* another IT fix
* yet another IT fix
* (will be reverted) add assertion for CI failure
* Revert "(will be reverted) add assertion for CI failure"
This reverts commit 78d5560f9e.
* switch back to json layout for test
* remove legacy logging config deprecations
* address some review comments
* update documentation
* update kibana.yml config examples
* add config example for `metrics.ops`
Co-authored-by: Tyler Smalley <tyler.smalley@elastic.co>
* Revert "Revert "Migrations v2: don't auto-create indices + FTR/esArchiver support (#85778)""
This reverts commit f97958043f.
* Fix flaky saved objects management test #89953
* If a clone target exists, wait for yellow, not green, index status
* Fix test after master merge
* Fix types
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* Migrations V2 on by default
* esArchiver delete migrations v2 indices
* Fix saved_objects_management api_integration tests
* Try to fix v2 migrations for pre-release builds
* esArchiver delete auto-created v2 migration indices like .kibana_8.0.0
* Try to fix v2 migrations for pre-release builds
* Use require_alias to prevent auto-created saved objects index
* Wrap SO routes until core logs all internal errors
* Fix api_integration tests requiring an empty kibana index
* Delete corrupt saved object from lens archives
* Update docs
* Fix ui_settings tests
* Fix core jest tests
* Fix type errors
* Fix accessibility tests
* Fix plugin functional tests
* Fix api_integration tests after merging in master
* Fix plugin functional tests #2
* EsArchiver: Don't reset ui settings after the .kibana index was deleted
* Fix functional management/visualize tests
* Fix oss security functional tests
* EsArchiver clean task manager indices to fix alerting api integration tests
* migrationsv2 correctly handle unknown saved object type mappings
* Revert "Try to fix v2 migrations for pre-release builds"
This reverts commit a1a1567501.
* Revert "Try to fix v2 migrations for pre-release builds"
This reverts commit a9a935558c.
* Re-enable v2 migrations in tests after merging in master
* Try to fix async dashboard functional test
* Restore UiSettings defaults after emptyKibanaIndex()
* Review feedback: rename test to match behaviour
* Enable v2 so migrations, disable in FTR tests
* Disable v2 migrations for ui_settings integration tests
* Disable v2 migrations for reporting without serucity api integration test
* [test/common] adding code coverage plugin
* start plugin only when CODE_COVERAGE flag is set
* build coverage plugin
* replace casting with custom Window interface
* Move defaultAppId config param into kibanaLegacy
* Move disableWelcomeScreen config param into Home plugin
* Update api and docs with silent option for renameFromRoot
* Additional validation for elasticsearch username
If "elastic" user is set in config:
* In dev mode, throws an error
* In prod mode, logs a deprecation warning
* Fix user for functional tests
* Revert last two commits
Revert "Fix user for functional tests" and
"Fix user for plugin functional tests in Jenkinsfile"
* Change elasticsearch creds for test server
Now uses "kibana" user instead of "elastic" user
* Fix plugin API functional tests
* Fix PKI API integration test
* Change log messages, now conditional on `dist: false` not `dev: true`
* Added base folder structure for Newsfeed plugin
* Added base folders for lib and component
* Added newsfeed button to navigation controls on the right side
* add getApi() to return api data observable (#49581)
* Added flyout base body and provided EuiHeaderAlert component inside the newsfeed plugin
* Moved newsfeed plugin to OSS and added for the styles purpose new folder for legacy plugin 'newsfeed' with the same id to support this
* Added subscribe on fetch newsfeed change
* Add NewsfeedApiDriver class (#49710)
* add NewsfeedApiDriver class
* fix xpack prefix
* add corner case handling
* Added data binding to the ui
* added EuiHeaderAlert style overrides (#49739)
* Fixed due to comments on PR
* add missing fields to NewsfeedItem and FetchResult
* fix templating of service url
* gracefully handle temporary request failure
* Mapped missing fields for data and badge
* Fixed typos issues
* integrate i18n.getLocale()
* allow service url root to be changed in dev mode
* replace a lot of consts with config
* fix flyout height (#49809)
* Add "error" field to FetchResult: Error | null
* simplify fetch error handling
* Do not store hash for items that are filtered out
* add expireOn in case it is useful to UI
* always use staging url for dev config
* unit test for newsfeed api driver
* simplify modelItems
* Fixed eslint errors
* Fixed label translations
* Add unit test for concatenating the stored hashes with the new
* add newsfeed to i18n.json
* Fixed expression error
* --wip-- [skip ci]
* fix parse error
* fix test
* test(newsfeed): Added testing endpoint which simulates the Elastic Newsfeed for consumption in functional tests
* add tests for getApi()
* add tests for getApi
* Added no news page
* fix fetch not happening after page refresh with sessionStorage primed
* test(newsfeed): Added testing endpoint which simulates the Elastic Newsfeed for consumption in functional tests
* Added loading screen
* Small fixes due to comments
* Fixed issue with stop fetching news on error catch
* test(newsfeed): Configure FTS to point newsfeed to the simulated newsfeed endpoit
* Fixed browser error message: Invariant Violation: [React Intl] Could not find required `intl` object. <IntlProvider> needs to exist in the component ancestry.
* Fixed typo issue in label name
* polish the code changes
* Add simple jest/enzyme tests for the components
* honor utc format
* Filter pre-published items
* Fall back to en
* retry tests
* comment clarfication
* Setup newsfeed service fixture from test/common/config
* Added base functional tests for newsfeed functionality
* valid urlroot is for prod
* add documentation for the supported enabled setting
* more urlRoot
* --wip-- [skip ci]
* add the before for fn
* add ui_capabilties test
* update jest snapshot
* Fixed failing test
* finish newsfeed error functional test
* include ui_capability config
* error case testing in ci group 6
* refactor(newsfeed): moved newsfeed api call so that it is done before its use
* code polish
* enabled newsfeed_err test in CI
* initial push
* self code review
* ignore node-fetch type
* usageFetcher api
* user agent metric
* telemetry plugin collector
* remove extra unused method
* remove unused import
* type check
* fix collections tests
* pass kfetch as dep
* add ui metrics integration test for user agent
* dont start ui metrics when not authenticated
* user agent count always 1
* fix broken ui-metric integration tests
* try using config.get
* avoid fetching configs if sending
* type unknown -> string
* check if fetcher is causing the issue
* disable ui_metric from functional tests
* enable ui_metric back again
* ignore keyword above 256
* check requesting app first
* clean up after all the debugging :)
* fix tests
* always return 200 for ui metric reporting
* remove boom import
* logout after removing role/user
* undo some changes in tests
* inside try catch
* prevent potential race conditions in priorities with =
* use snake_case for telemetry plugin collection
* usageFetcher -> sendUsageFrom
* more replacements
* remove extra unused route
* config() -> config
* Update src/legacy/core_plugins/telemetry/index.ts
Co-Authored-By: Mike Côté <mikecote@users.noreply.github.com>
* Update src/legacy/core_plugins/ui_metric/server/routes/api/ui_metric.ts
Co-Authored-By: Mike Côté <mikecote@users.noreply.github.com>
* config() -> config
* fix SO update logic given the current changes
* fix opt in check
* triple check
* check for non boolean
* take into account older settings
* import TelemetryOptInProvider
* update test case
In https://github.com/elastic/kibana/pull/31234 there were some extra changes that I've reverted, like use of the `tsconfig-paths` package to magically rewrite import statements to defy the standard node module resolution algorithm, the inclusion of several unnecessary options in the `test/tsconfig.json` file, and changes of the line-endings in the config files. This also brings a few enhancements from https://github.com/elastic/kibana/pull/30190 including a modularized version of the expect.js types, and options for explicit mappings for the PageObjects and services used in ftr tests.
As suggested by @legrego in #28792, this PR adds a config flag to completely disable the welcome screen, which is enabled by the functional test runner to ensure that the welcome screen doesn't pop up.
Right now the functional tests are run against a distributable of Kibana in CI, but that distributable is running with `--env.name=development`. That causes the optimizer to run again before the tests can start and prevents the functional tests from running against the actual version of the application users will end up getting. This seems necessary for some tests, but not all of them, but I would like to get all of the tests running against the production version of Kibana soon.
This PR implements a second ftr config, `test/functional_production` that uses basically a copy of the `test/functional` config but with a few minor adjustments, removing the `--env.name=development` kbnServerArg and using a unique junit report name. To accomplish this I needed to modify the `@kbn/test` module to only pass the `--dev` flag to the Kibana server if it is being run in development mode, which it currently does by testing the args for `--env.name=development` or two args next to each other: `'--env.name'` and `'development'`. It does this by converting the `extraKbnOpts` option into an `addExtraKbnArgs` function, which is called with the final args just before passing them to the proc runner and given a chance to modify then after all other args are resolved (pulling from different places in config based on the build type, etc.)
Over the next couple weeks I'll push up PRs for individual test suites, migrating them over to the new production config, hopefully in a short period of time we will have all the function test suites back under that `test/function` config and can run them all against the Kibana server in production mode.
* Replace test:api with @kbn/test runTests
* Improve CLI help menu 🆘
* Use --es-from
* Replace jenkins:selenium with kbn-test
* Validate cli args, fixing test in the process
* Clean up some stuff
* Code review fixes
* Explanation for collectCliArgs
* Remove exit codes, they're useless anyway.
* Make markdown vis test pass with dev_mode setting
* Tests
* Remove unneeded export
* Code review: move console logging up to cli.js
* Code review: refactor startServers and runTests to take single options collection
* Code review: Remove all things I am sure we do not use
* Improve tests
* Code review fixes
* Pass created log to runFtr, runElasticsearch, runKibanaServer
* Update --es-from option to --esFrom
