Your window into the Elastic Stack
Find a file
Larry Gregory 9ce2dd8df9
Additional prototype pollution protections (#206073)
## Summary

1. Extends the server-side prototype pollution protections introduced in
https://github.com/elastic/kibana/pull/190716 to include
`Array.prototype`.
2. Applies the same prototype pollution protections to the client-side.


### Identify risks

Does this PR introduce any risks? For example, consider risks like hard
to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified
risk. Invite stakeholders and evaluate how to proceed before merging.

- [ ] Sealing prototypes on the client can lead to failures in
third-party dependencies. I'm relying on sufficient functional test
coverage to detect issues here. As a result, these protections are
disabled by default for now, and can be controlled via setting
`server.prototypeHardening: true/false`

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2025-01-28 23:00:43 +01:00
.buildkite [ci] Don't start APM/Profiling cypress if pre-checks don't pass (#208569) 2025-01-28 18:19:52 +01:00
.devcontainer Removing experimental for the FIPS mode config (#200734) 2024-11-19 15:23:20 -05:00
.github Additional prototype pollution protections (#206073) 2025-01-28 23:00:43 +01:00
api_docs [Automatic Import] rename plugin to automatic import (#207325) 2025-01-28 21:55:42 +01:00
config [Security Solution] Fix old siem feature override (#207333) 2025-01-21 15:50:53 +01:00
dev_docs SKA: Update broken references and URLs (#206836) 2025-01-28 03:32:48 +00:00
docs [Automatic Import] rename plugin to automatic import (#207325) 2025-01-28 21:55:42 +01:00
examples SKA: Update broken references and URLs (#206836) 2025-01-28 03:32:48 +00:00
kbn_pm Sustainable Kibana Architecture: Move CodeEditor related packages #205587 (#205738) 2025-01-08 15:25:47 +01:00
legacy_rfcs SKA: Update broken references and URLs (#206836) 2025-01-28 03:32:48 +00:00
licenses Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
oas_docs [Security Assistant] Add Knowledge Base entries API (#206407) 2025-01-28 20:19:55 +01:00
packages Additional prototype pollution protections (#206073) 2025-01-28 23:00:43 +01:00
plugins
scripts SKA: Update broken references and URLs (#206836) 2025-01-28 03:32:48 +00:00
src Additional prototype pollution protections (#206073) 2025-01-28 23:00:43 +01:00
test Additional prototype pollution protections (#206073) 2025-01-28 23:00:43 +01:00
typings make emotion typing global (#200958) 2024-12-05 12:20:43 -06:00
x-pack Additional prototype pollution protections (#206073) 2025-01-28 23:00:43 +01:00
.backportrc.json chore(NA): adds 8.17 into backportrc (#201065) 2024-11-21 06:05:29 +00:00
.bazelignore Remove references to deleted .ci folder (#177168) 2024-02-20 19:54:21 +01:00
.bazeliskversion chore(NA): upgrade bazelisk into v1.11.0 (#125070) 2022-02-09 20:43:57 +00:00
.bazelrc chore(NA): use new and more performant BuildBuddy servers (#130350) 2022-04-18 02:01:38 +01:00
.bazelrc.common Transpile packages on demand, validate all TS projects (#146212) 2022-12-22 19:00:29 -06:00
.bazelversion chore(NA): revert bazel upgrade for v5.2.0 (#135096) 2022-06-24 03:57:21 +01:00
.browserslistrc Add Firefox ESR to browserlistrc (#184462) 2024-05-29 17:53:18 -05:00
.editorconfig
.eslintignore SKA: Fix outdated eslint rules (#206961) 2025-01-28 08:49:39 +01:00
.eslintrc.js Remove unused eslint rule !! (#208508) 2025-01-28 22:08:43 +01:00
.gitattributes
.gitignore [Investigate App] add MVP evaluation framework for AI root cause analysis integration (#204634) 2025-01-17 12:16:10 -05:00
.i18nrc.json SKA: Relocate @kbn/grid-layout (#206821) 2025-01-15 17:39:41 +00:00
.node-version Upgrade Node.js to 20.18.2 (#207431) 2025-01-22 12:00:14 -06:00
.npmrc [npmrc] Fix puppeteer_skip_download configuration (#177673) 2024-02-22 18:59:01 -07:00
.nvmrc Upgrade Node.js to 20.18.2 (#207431) 2025-01-22 12:00:14 -06:00
.prettierignore
.prettierrc
.puppeteerrc Add .puppeteerrc (#179847) 2024-04-03 09:14:39 -05:00
.stylelintignore
.stylelintrc Bump stylelint to ^14 (#136693) 2022-07-20 10:11:00 -05:00
.telemetryrc.json Sustainable Kibana Architecture: Move modules owned by @elastic/kibana-core (#201653) 2025-01-04 11:47:24 -07:00
.yarnrc
BUILD.bazel Transpile packages on demand, validate all TS projects (#146212) 2022-12-22 19:00:29 -06:00
catalog-info.yaml Configures PagerDuty Backstage Integration for kbn (#208440) 2025-01-27 23:29:11 +00:00
CODE_OF_CONDUCT.md
CONTRIBUTING.md
FAQ.md Fix small typos in the root md files (#134609) 2022-06-23 09:36:11 -05:00
fleet_packages.json [main] Sync bundled packages with Package Storage (#192007) 2024-09-03 12:26:57 -05:00
github_checks_reporter.json
kibana.d.ts Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
LICENSE.txt Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
NOTICE.txt [api-docs] 2025-01-01 Daily api_docs build (#205342) 2025-01-01 01:37:13 -06:00
package.json Additional prototype pollution protections (#206073) 2025-01-28 23:00:43 +01:00
preinstall_check.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
README.md
renovate.json Renovate - Move filesaver to its own group to upgrade it independently (#208246) 2025-01-24 20:58:23 +00:00
RISK_MATRIX.mdx
run_fleet_setup_parallel.sh Sustainable Kibana Architecture: Move modules owned by @elastic/fleet (#202422) 2024-12-24 15:32:43 +01:00
SECURITY.md
sonar-project.properties [sonarqube] update memory, cpu (#190547) 2024-09-09 16:16:30 -05:00
STYLEGUIDE.mdx [styleguide] update path to scss theme (#140742) 2022-09-15 10:41:14 -04:00
tsconfig.base.json [Automatic Import] rename plugin to automatic import (#207325) 2025-01-28 21:55:42 +01:00
tsconfig.browser.json
tsconfig.browser_bazel.json
tsconfig.json Transpile packages on demand, validate all TS projects (#146212) 2022-12-22 19:00:29 -06:00
TYPESCRIPT.md Fix small typos in the root md files (#134609) 2022-06-23 09:36:11 -05:00
updatecli-compose.yaml deps(updatecli): bump all policies (#195865) 2024-10-15 07:37:12 -05:00
versions.json chore(NA): update versions after v8.17.2 bump (#207411) 2025-01-21 19:12:43 +00:00
WORKSPACE.bazel Upgrade Node.js to 20.18.2 (#207431) 2025-01-22 12:00:14 -06:00
yarn.lock Additional prototype pollution protections (#206073) 2025-01-28 23:00:43 +01:00

Kibana

Kibana is your window into the Elastic Stack. Specifically, it's a browser-based analytics and search dashboard for Elasticsearch.

Getting Started

If you just want to try Kibana out, check out the Elastic Stack Getting Started Page to give it a whirl.

If you're interested in diving a bit deeper and getting a taste of Kibana's capabilities, head over to the Kibana Getting Started Page.

Using a Kibana Release

If you want to use a Kibana release in production, give it a test run, or just play around:

Building and Running Kibana, and/or Contributing Code

You might want to build Kibana locally to contribute some code, test out the latest features, or try out an open PR:

Documentation

Visit Elastic.co for the full Kibana documentation.

For information about building the documentation, see the README in elastic/docs.

Version Compatibility with Elasticsearch

Ideally, you should be running Elasticsearch and Kibana with matching version numbers. If your Elasticsearch has an older version number or a newer major number than Kibana, then Kibana will fail to run. If Elasticsearch has a newer minor or patch number than Kibana, then the Kibana Server will log a warning.

Note: The version numbers below are only examples, meant to illustrate the relationships between different types of version numbers.

Situation Example Kibana version Example ES version Outcome
Versions are the same. 7.15.1 7.15.1 💚 OK
ES patch number is newer. 7.15.0 7.15.1 ⚠️ Logged warning
ES minor number is newer. 7.14.2 7.15.0 ⚠️ Logged warning
ES major number is newer. 7.15.1 8.0.0 🚫 Fatal error
ES patch number is older. 7.15.1 7.15.0 ⚠️ Logged warning
ES minor number is older. 7.15.1 7.14.2 🚫 Fatal error
ES major number is older. 8.0.0 7.15.1 🚫 Fatal error

Questions? Problems? Suggestions?

  • If you've found a bug or want to request a feature, please create a GitHub Issue. Please check to make sure someone else hasn't already created an issue for the same topic.
  • Need help using Kibana? Ask away on our Kibana Discuss Forum and a fellow community member or Elastic engineer will be glad to help you out.