Merge branch 'main' into rops/monitoring_ui_integration

.bazelversion

@@ -1 +1 @@
-5.1.1
+5.2.0

.buildkite/pipelines/performance/daily.yml

@@ -19,11 +19,11 @@ steps:
     depends_on: build
     key: tests
 
-  - label: ':shipit: Performance Tests dataset extraction for scalability benchmarking'
-    command: .buildkite/scripts/steps/functional/scalability_dataset_extraction.sh
-    agents:
-      queue: n2-2
-    depends_on: tests
+  # - label: ':shipit: Performance Tests dataset extraction for scalability benchmarking'
+  #   command: .buildkite/scripts/steps/functional/scalability_dataset_extraction.sh
+  #   agents:
+  #     queue: n2-2
+  #   depends_on: tests
 
   - wait: ~
     continue_on_failure: true

package.json

@@ -277,7 +277,7 @@
     "deep-freeze-strict": "^1.1.1",
     "deepmerge": "^4.2.2",
     "del": "^5.1.0",
-    "elastic-apm-node": "^3.34.0",
+    "elastic-apm-node": "^3.35.0",
     "email-addresses": "^5.0.0",
     "execa": "^4.0.2",
     "exit-hook": "^2.2.0",
@@ -288,6 +288,7 @@
     "file-saver": "^1.3.8",
     "file-type": "^10.9.0",
     "font-awesome": "4.7.0",
+    "formik": "^2.2.9",
     "fp-ts": "^2.3.1",
     "geojson-vt": "^3.2.1",
     "get-port": "^5.0.0",

packages/kbn-optimizer/limits.yml

@@ -52,7 +52,7 @@ pageLoadAssetSize:
   savedObjectsTagging: 59482
   savedObjectsTaggingOss: 20590
   searchprofiler: 67080
-  security: 95864
+  security: 115240
   snapshotRestore: 79032
   spaces: 57868
   telemetry: 51957

renovate.json

@@ -115,6 +115,7 @@
       "groupName": "platform security modules",
       "matchPackageNames": [
         "node-forge",
+        "formik",
         "@types/node-forge",
         "require-in-the-middle",
         "tough-cookie",

src/plugins/vis_types/vega/public/vega_view/utils.test.ts

@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { normalizeString, normalizeObject, normalizeDate } from './utils';
+
+describe('normalizeString', () => {
+  test('should return undefined for non string input', async () => {
+    expect(normalizeString({})).toBe(undefined);
+    expect(normalizeString(12344)).toBe(undefined);
+    expect(normalizeString(null)).toBe(undefined);
+  });
+
+  test('should return the string for string input', async () => {
+    expect(normalizeString('logstash')).toBe('logstash');
+  });
+});
+
+describe('normalizeDate', () => {
+  test('should return timestamp if timestamp is given', async () => {
+    expect(normalizeDate(1654702414)).toBe(1654702414);
+  });
+
+  test('should return null if NaN is given', async () => {
+    expect(normalizeDate(NaN)).toBe(null);
+  });
+
+  test('should return date if a date object is given', async () => {
+    const date = Date.now();
+    expect(normalizeDate(date)).toBe(date);
+  });
+
+  test('should return undefined for a string', async () => {
+    expect(normalizeDate('test')).toBe('test');
+  });
+
+  test('should return the object if object is given', async () => {
+    expect(normalizeDate({ test: 'test' })).toStrictEqual({ test: 'test' });
+  });
+});
+
+describe('normalizeObject', () => {
+  test('should throw if a function is given as the object property', async () => {
+    expect(() => {
+      normalizeObject({ toJSON: () => alert('gotcha') });
+    }).toThrow('a function cannot be used as a property name');
+  });
+
+  test('should throw if a function is given on a nested object', async () => {
+    expect(() => {
+      normalizeObject({ test: { toJSON: () => alert('gotcha') } });
+    }).toThrow('a function cannot be used as a property name');
+  });
+
+  test('should return null for null', async () => {
+    expect(normalizeObject(null)).toBe(null);
+  });
+
+  test('should return null for undefined', async () => {
+    expect(normalizeObject(undefined)).toBe(null);
+  });
+
+  test('should return the object', async () => {
+    expect(normalizeObject({ test: 'test' })).toStrictEqual({ test: 'test' });
+  });
+});

src/plugins/vis_types/vega/public/vega_view/utils.ts

@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import { ensureNoUnsafeProperties } from '@kbn/std';
+
+export function normalizeDate(date: unknown) {
+  if (typeof date === 'number') {
+    return !isNaN(date) ? date : null;
+  } else if (date instanceof Date) {
+    return date;
+  } else {
+    return normalizeObject(date);
+  }
+}
+
+/*
+Recursive function to check a nested object for a function property
+This function should run before JSON.stringify to ensure that functions such as toJSON
+are not invoked. We dont use the replacer function as it doesnt catch the toJSON function
+*/
+export function checkObjectForFunctionProperty(object: unknown): boolean {
+  if (object === null || object === undefined) {
+    return false;
+  }
+  if (typeof object === 'function') {
+    return true;
+  }
+  if (object && typeof object === 'object') {
+    return Object.values(object).some(
+      (value) => typeof value === 'function' || checkObjectForFunctionProperty(value)
+    );
+  }
+
+  return false;
+}
+/*
+  We want to be strict here when an object is passed to a Vega function
+  - NaN (will be converted to null)
+  - undefined (key will be removed)
+  - Date (will be replaced by its toString value)
+  - will throw an error when a function is found
+  */
+export function normalizeObject(object: unknown) {
+  if (checkObjectForFunctionProperty(object)) {
+    throw new Error('a function cannot be used as a property name');
+  }
+  const normalizedObject = object ? JSON.parse(JSON.stringify(object)) : null;
+  ensureNoUnsafeProperties(normalizedObject);
+  return normalizedObject;
+}
+
+export function normalizeString(string: unknown) {
+  return typeof string === 'string' ? string : undefined;
+}

src/plugins/vis_types/vega/public/vega_view/vega_base_view.js

@@ -20,6 +20,7 @@ import { TooltipHandler } from './vega_tooltip';
 
 import { getEnableExternalUrls, getDataViews } from '../services';
 import { extractIndexPatternsFromSpec } from '../lib/extract_index_pattern';
+import { normalizeDate, normalizeString, normalizeObject } from './utils';
 
 scheme('elastic', euiPaletteColorBlind());
 
@@ -350,8 +351,11 @@ export class VegaBaseView {
    * @param {string} Elastic Query DSL's Custom label for kibanaAddFilter, as used in '+ Add Filter'
    */
   async addFilterHandler(query, index, alias) {
-    const indexId = await this.findIndex(index);
-    const filter = buildQueryFilter(query, indexId, alias);
+    const normalizedQuery = normalizeObject(query);
+    const normalizedIndex = normalizeString(index);
+    const normalizedAlias = normalizeString(alias);
+    const indexId = await this.findIndex(normalizedIndex);
+    const filter = buildQueryFilter(normalizedQuery, indexId, normalizedAlias);
 
     this._fireEvent({ name: 'applyFilter', data: { filters: [filter] } });
   }
@@ -361,8 +365,10 @@ export class VegaBaseView {
    * @param {string} [index] as defined in Kibana, or default if missing
    */
   async removeFilterHandler(query, index) {
-    const indexId = await this.findIndex(index);
-    const filterToRemove = buildQueryFilter(query, indexId);
+    const normalizedQuery = normalizeObject(query);
+    const normalizedIndex = normalizeString(index);
+    const indexId = await this.findIndex(normalizedIndex);
+    const filterToRemove = buildQueryFilter(normalizedQuery, indexId);
 
     const currentFilters = this._filterManager.getFilters();
     const existingFilter = currentFilters.find((filter) => compareFilters(filter, filterToRemove));
@@ -386,7 +392,9 @@ export class VegaBaseView {
    * @param {number|string|Date} end
    */
   setTimeFilterHandler(start, end) {
-    const { from, to, mode } = VegaBaseView._parseTimeRange(start, end);
+    const normalizedStart = normalizeDate(start);
+    const normalizedEnd = normalizeDate(end);
+    const { from, to, mode } = VegaBaseView._parseTimeRange(normalizedStart, normalizedEnd);
 
     this._fireEvent({
       name: 'applyFilter',

src/plugins/visualizations/public/embeddable/visualize_embeddable.tsx

@@ -393,7 +393,9 @@ export class VisualizeEmbeddable
     this.subscriptions.push(this.handler.render$.subscribe(this.onContainerRender));
 
     this.subscriptions.push(
-      this.getOutput$().subscribe(({ error }) => {
+      this.getUpdated$().subscribe(() => {
+        const { error } = this.getOutput();
+
         if (error) {
           if (isFallbackDataView(this.vis.data.indexPattern)) {
             render(