[Security Solution] Diff view incorrectly highlights changes in multiline strings #202016
Assignees
Labels
8.18 candidate
bug
Fixes for quality problems that affect the customer experience
Feature:Prebuilt Detection Rules
Security Solution Prebuilt Detection Rules area
impact:medium
Addressing this issue will have a medium level of impact on the quality/strength of our product.
Team:Detection Rule Management
Security Detection Rule Management Team
Team:Detections and Resp
Security Detection Response Team
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
v8.18.0
Comments
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
|
Pinging @elastic/security-detections-response (Team:Detections and Resp) |
|
Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management) |
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this issue
Dec 30, 2024
…lastic#205138) **Resolves: elastic#202016 ## Summary This PR resolves an issue where the diff view incorrectly marked certain characters as changed (using bold font) in some cases. ## Root Cause The issue arises from a bug in the `diff` library (v5). The library is used to compute two-way diffs between strings (old field value and new field value), producing an array of change objects that is then used for rendering. Conditions for the bug: - `diff` v5 library is in use (fixed in v6 and above) and `DiffMethod.WORDS` is passed as a parameter to it. - The old field value contains a line with an addition separated by a space (see example below). - The next line contains some changes (additions, deletions, or updates). For example, for these input strings: ``` foo bar spring ``` ``` foo sprint ``` | You would expect to see this diff | But you actually see this | |----------|----------| | <img width="119" alt="expected" src="https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247" /> | <img width="118" alt="actual" src="https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079" /> | **A more real-life example** <img width="1661" alt="more_real_life" src="https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b" /> ## Solution Switching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue. Screenshot showing the difference between `DiffMethod.WORDS` and `DiffMethod.WORDS_WITH_SPACE`: <img width="675" alt="words_vs_words_with_space" src="https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a" /> ## Other changes - Removed `DiffMethod.TRIMMED_LINES` since it's now [deprecated](kpdecker/jsdiff#486) in the `diff` library and we are not using it anyways. - Stopped using the "zip" option since I believe it produces a less readable diff, especially for cases when there's a different number of lines in the original value vs updated value. <details> <summary><strong>Screenshots: with and without "zip" (click to expand)</strong></summary> <strong>With the "zip" option (how it was before)</strong> <img width="1918" alt="zip" src="https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e" /> <strong>No "zip" (this branch)</strong> <img width="1919" alt="no_zip" src="https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956" /> </details> ## Testing I thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across various inputs and scenarios, including: - Single-line and multi-line strings. - Numbers, arrays, and objects. - Additions, deletions, and updates at different positions (start, middle, and end) within and across lines. I also validated diffs against real prebuilt rules by installing an older Fleet package version and observed no issues. You can test by trying different input strings and settings in Storybook. **Run Storybook**: `yarn storybook security_solution`. https://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e You can notice that `ComparisonSide` stories are broken, but that's unrelated to these changes and needs to be handled separately. ## Compatibility with future upgrades There's an open [PR](elastic#202622) that will upgrade the `diff` library from v5 to v7. I verified the behavior of `DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences compared to v5, so it should be safe to upgrade to v7 without any changes on our end. Work started on 23-Dec-2024. (cherry picked from commit 140c2e0)
stratoula
pushed a commit
to stratoula/kibana
that referenced
this issue
Jan 2, 2025
…lastic#205138) **Resolves: elastic#202016 ## Summary This PR resolves an issue where the diff view incorrectly marked certain characters as changed (using bold font) in some cases. ## Root Cause The issue arises from a bug in the `diff` library (v5). The library is used to compute two-way diffs between strings (old field value and new field value), producing an array of change objects that is then used for rendering. Conditions for the bug: - `diff` v5 library is in use (fixed in v6 and above) and `DiffMethod.WORDS` is passed as a parameter to it. - The old field value contains a line with an addition separated by a space (see example below). - The next line contains some changes (additions, deletions, or updates). For example, for these input strings: ``` foo bar spring ``` ``` foo sprint ``` | You would expect to see this diff | But you actually see this | |----------|----------| | <img width="119" alt="expected" src="https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247" /> | <img width="118" alt="actual" src="https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079" /> | **A more real-life example** <img width="1661" alt="more_real_life" src="https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b" /> ## Solution Switching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue. Screenshot showing the difference between `DiffMethod.WORDS` and `DiffMethod.WORDS_WITH_SPACE`: <img width="675" alt="words_vs_words_with_space" src="https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a" /> ## Other changes - Removed `DiffMethod.TRIMMED_LINES` since it's now [deprecated](kpdecker/jsdiff#486) in the `diff` library and we are not using it anyways. - Stopped using the "zip" option since I believe it produces a less readable diff, especially for cases when there's a different number of lines in the original value vs updated value. <details> <summary><strong>Screenshots: with and without "zip" (click to expand)</strong></summary> <strong>With the "zip" option (how it was before)</strong> <img width="1918" alt="zip" src="https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e" /> <strong>No "zip" (this branch)</strong> <img width="1919" alt="no_zip" src="https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956" /> </details> ## Testing I thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across various inputs and scenarios, including: - Single-line and multi-line strings. - Numbers, arrays, and objects. - Additions, deletions, and updates at different positions (start, middle, and end) within and across lines. I also validated diffs against real prebuilt rules by installing an older Fleet package version and observed no issues. You can test by trying different input strings and settings in Storybook. **Run Storybook**: `yarn storybook security_solution`. https://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e You can notice that `ComparisonSide` stories are broken, but that's unrelated to these changes and needs to be handled separately. ## Compatibility with future upgrades There's an open [PR](elastic#202622) that will upgrade the `diff` library from v5 to v7. I verified the behavior of `DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences compared to v5, so it should be safe to upgrade to v7 without any changes on our end. Work started on 23-Dec-2024.
benakansara
pushed a commit
to benakansara/kibana
that referenced
this issue
Jan 2, 2025
…lastic#205138) **Resolves: elastic#202016 ## Summary This PR resolves an issue where the diff view incorrectly marked certain characters as changed (using bold font) in some cases. ## Root Cause The issue arises from a bug in the `diff` library (v5). The library is used to compute two-way diffs between strings (old field value and new field value), producing an array of change objects that is then used for rendering. Conditions for the bug: - `diff` v5 library is in use (fixed in v6 and above) and `DiffMethod.WORDS` is passed as a parameter to it. - The old field value contains a line with an addition separated by a space (see example below). - The next line contains some changes (additions, deletions, or updates). For example, for these input strings: ``` foo bar spring ``` ``` foo sprint ``` | You would expect to see this diff | But you actually see this | |----------|----------| | <img width="119" alt="expected" src="https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247" /> | <img width="118" alt="actual" src="https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079" /> | **A more real-life example** <img width="1661" alt="more_real_life" src="https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b" /> ## Solution Switching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue. Screenshot showing the difference between `DiffMethod.WORDS` and `DiffMethod.WORDS_WITH_SPACE`: <img width="675" alt="words_vs_words_with_space" src="https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a" /> ## Other changes - Removed `DiffMethod.TRIMMED_LINES` since it's now [deprecated](kpdecker/jsdiff#486) in the `diff` library and we are not using it anyways. - Stopped using the "zip" option since I believe it produces a less readable diff, especially for cases when there's a different number of lines in the original value vs updated value. <details> <summary><strong>Screenshots: with and without "zip" (click to expand)</strong></summary> <strong>With the "zip" option (how it was before)</strong> <img width="1918" alt="zip" src="https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e" /> <strong>No "zip" (this branch)</strong> <img width="1919" alt="no_zip" src="https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956" /> </details> ## Testing I thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across various inputs and scenarios, including: - Single-line and multi-line strings. - Numbers, arrays, and objects. - Additions, deletions, and updates at different positions (start, middle, and end) within and across lines. I also validated diffs against real prebuilt rules by installing an older Fleet package version and observed no issues. You can test by trying different input strings and settings in Storybook. **Run Storybook**: `yarn storybook security_solution`. https://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e You can notice that `ComparisonSide` stories are broken, but that's unrelated to these changes and needs to be handled separately. ## Compatibility with future upgrades There's an open [PR](elastic#202622) that will upgrade the `diff` library from v5 to v7. I verified the behavior of `DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences compared to v5, so it should be safe to upgrade to v7 without any changes on our end. Work started on 23-Dec-2024.
cqliu1
pushed a commit
to cqliu1/kibana
that referenced
this issue
Jan 2, 2025
…lastic#205138) **Resolves: elastic#202016 ## Summary This PR resolves an issue where the diff view incorrectly marked certain characters as changed (using bold font) in some cases. ## Root Cause The issue arises from a bug in the `diff` library (v5). The library is used to compute two-way diffs between strings (old field value and new field value), producing an array of change objects that is then used for rendering. Conditions for the bug: - `diff` v5 library is in use (fixed in v6 and above) and `DiffMethod.WORDS` is passed as a parameter to it. - The old field value contains a line with an addition separated by a space (see example below). - The next line contains some changes (additions, deletions, or updates). For example, for these input strings: ``` foo bar spring ``` ``` foo sprint ``` | You would expect to see this diff | But you actually see this | |----------|----------| | <img width="119" alt="expected" src="https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247" /> | <img width="118" alt="actual" src="https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079" /> | **A more real-life example** <img width="1661" alt="more_real_life" src="https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b" /> ## Solution Switching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue. Screenshot showing the difference between `DiffMethod.WORDS` and `DiffMethod.WORDS_WITH_SPACE`: <img width="675" alt="words_vs_words_with_space" src="https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a" /> ## Other changes - Removed `DiffMethod.TRIMMED_LINES` since it's now [deprecated](kpdecker/jsdiff#486) in the `diff` library and we are not using it anyways. - Stopped using the "zip" option since I believe it produces a less readable diff, especially for cases when there's a different number of lines in the original value vs updated value. <details> <summary><strong>Screenshots: with and without "zip" (click to expand)</strong></summary> <strong>With the "zip" option (how it was before)</strong> <img width="1918" alt="zip" src="https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e" /> <strong>No "zip" (this branch)</strong> <img width="1919" alt="no_zip" src="https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956" /> </details> ## Testing I thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across various inputs and scenarios, including: - Single-line and multi-line strings. - Numbers, arrays, and objects. - Additions, deletions, and updates at different positions (start, middle, and end) within and across lines. I also validated diffs against real prebuilt rules by installing an older Fleet package version and observed no issues. You can test by trying different input strings and settings in Storybook. **Run Storybook**: `yarn storybook security_solution`. https://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e You can notice that `ComparisonSide` stories are broken, but that's unrelated to these changes and needs to be handled separately. ## Compatibility with future upgrades There's an open [PR](elastic#202622) that will upgrade the `diff` library from v5 to v7. I verified the behavior of `DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences compared to v5, so it should be safe to upgrade to v7 without any changes on our end. Work started on 23-Dec-2024.
nikitaindik
added a commit
to nikitaindik/kibana
that referenced
this issue
Jan 6, 2025
…lastic#205138) **Resolves: elastic#202016 ## Summary This PR resolves an issue where the diff view incorrectly marked certain characters as changed (using bold font) in some cases. ## Root Cause The issue arises from a bug in the `diff` library (v5). The library is used to compute two-way diffs between strings (old field value and new field value), producing an array of change objects that is then used for rendering. Conditions for the bug: - `diff` v5 library is in use (fixed in v6 and above) and `DiffMethod.WORDS` is passed as a parameter to it. - The old field value contains a line with an addition separated by a space (see example below). - The next line contains some changes (additions, deletions, or updates). For example, for these input strings: ``` foo bar spring ``` ``` foo sprint ``` | You would expect to see this diff | But you actually see this | |----------|----------| | <img width="119" alt="expected" src="https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247" /> | <img width="118" alt="actual" src="https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079" /> | **A more real-life example** <img width="1661" alt="more_real_life" src="https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b" /> ## Solution Switching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue. Screenshot showing the difference between `DiffMethod.WORDS` and `DiffMethod.WORDS_WITH_SPACE`: <img width="675" alt="words_vs_words_with_space" src="https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a" /> ## Other changes - Removed `DiffMethod.TRIMMED_LINES` since it's now [deprecated](kpdecker/jsdiff#486) in the `diff` library and we are not using it anyways. - Stopped using the "zip" option since I believe it produces a less readable diff, especially for cases when there's a different number of lines in the original value vs updated value. <details> <summary><strong>Screenshots: with and without "zip" (click to expand)</strong></summary> <strong>With the "zip" option (how it was before)</strong> <img width="1918" alt="zip" src="https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e" /> <strong>No "zip" (this branch)</strong> <img width="1919" alt="no_zip" src="https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956" /> </details> ## Testing I thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across various inputs and scenarios, including: - Single-line and multi-line strings. - Numbers, arrays, and objects. - Additions, deletions, and updates at different positions (start, middle, and end) within and across lines. I also validated diffs against real prebuilt rules by installing an older Fleet package version and observed no issues. You can test by trying different input strings and settings in Storybook. **Run Storybook**: `yarn storybook security_solution`. https://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e You can notice that `ComparisonSide` stories are broken, but that's unrelated to these changes and needs to be handled separately. ## Compatibility with future upgrades There's an open [PR](elastic#202622) that will upgrade the `diff` library from v5 to v7. I verified the behavior of `DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences compared to v5, so it should be safe to upgrade to v7 without any changes on our end. Work started on 23-Dec-2024. (cherry picked from commit 140c2e0) # Conflicts: # x-pack/plugins/security_solution/public/detection_engine/rule_management/components/rule_details/json_diff/diff_view.stories.tsx
nikitaindik
added a commit
to nikitaindik/kibana
that referenced
this issue
Jan 6, 2025
…lastic#205138) **Resolves: elastic#202016 ## Summary This PR resolves an issue where the diff view incorrectly marked certain characters as changed (using bold font) in some cases. ## Root Cause The issue arises from a bug in the `diff` library (v5). The library is used to compute two-way diffs between strings (old field value and new field value), producing an array of change objects that is then used for rendering. Conditions for the bug: - `diff` v5 library is in use (fixed in v6 and above) and `DiffMethod.WORDS` is passed as a parameter to it. - The old field value contains a line with an addition separated by a space (see example below). - The next line contains some changes (additions, deletions, or updates). For example, for these input strings: ``` foo bar spring ``` ``` foo sprint ``` | You would expect to see this diff | But you actually see this | |----------|----------| | <img width="119" alt="expected" src="https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247" /> | <img width="118" alt="actual" src="https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079" /> | **A more real-life example** <img width="1661" alt="more_real_life" src="https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b" /> ## Solution Switching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue. Screenshot showing the difference between `DiffMethod.WORDS` and `DiffMethod.WORDS_WITH_SPACE`: <img width="675" alt="words_vs_words_with_space" src="https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a" /> ## Other changes - Removed `DiffMethod.TRIMMED_LINES` since it's now [deprecated](kpdecker/jsdiff#486) in the `diff` library and we are not using it anyways. - Stopped using the "zip" option since I believe it produces a less readable diff, especially for cases when there's a different number of lines in the original value vs updated value. <details> <summary><strong>Screenshots: with and without "zip" (click to expand)</strong></summary> <strong>With the "zip" option (how it was before)</strong> <img width="1918" alt="zip" src="https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e" /> <strong>No "zip" (this branch)</strong> <img width="1919" alt="no_zip" src="https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956" /> </details> ## Testing I thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across various inputs and scenarios, including: - Single-line and multi-line strings. - Numbers, arrays, and objects. - Additions, deletions, and updates at different positions (start, middle, and end) within and across lines. I also validated diffs against real prebuilt rules by installing an older Fleet package version and observed no issues. You can test by trying different input strings and settings in Storybook. **Run Storybook**: `yarn storybook security_solution`. https://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e You can notice that `ComparisonSide` stories are broken, but that's unrelated to these changes and needs to be handled separately. ## Compatibility with future upgrades There's an open [PR](elastic#202622) that will upgrade the `diff` library from v5 to v7. I verified the behavior of `DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences compared to v5, so it should be safe to upgrade to v7 without any changes on our end. Work started on 23-Dec-2024. (cherry picked from commit 140c2e0) # Conflicts: # x-pack/plugins/security_solution/public/detection_engine/rule_management/components/rule_details/json_diff/diff_view.stories.tsx
nikitaindik
added a commit
that referenced
this issue
Jan 6, 2025
… view (#205138) (#205612) # Backport This will backport the following commits from `main` to `8.16`: - [[Security Solution] Fix incorrect changes highlighting in diff view (#205138)](#205138) <!--- Backport version: 8.9.8 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Nikita Indik","email":"nikita.indik@elastic.co"},"sourceCommit":{"committedDate":"2024-12-30T12:38:42Z","message":"[Security Solution] Fix incorrect changes highlighting in diff view (#205138)\n\n**Resolves: https://github.com/elastic/kibana/issues/202016**\n\n## Summary\n\nThis PR resolves an issue where the diff view incorrectly marked certain\ncharacters as changed (using bold font) in some cases.\n\n## Root Cause\nThe issue arises from a bug in the `diff` library (v5). The library is\nused to compute two-way diffs between strings (old field value and new\nfield value), producing an array of change objects that is then used for\nrendering.\n\nConditions for the bug:\n- `diff` v5 library is in use (fixed in v6 and above) and\n`DiffMethod.WORDS` is passed as a parameter to it.\n- The old field value contains a line with an addition separated by a\nspace (see example below).\n- The next line contains some changes (additions, deletions, or\nupdates).\n\n\nFor example, for these input strings:\n```\nfoo bar\nspring\n```\n```\nfoo\nsprint\n```\n\n| You would expect to see this diff | But you actually see this |\n|----------|----------|\n| <img width=\"119\" alt=\"expected\"\nsrc=\"https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247\"\n/> | <img width=\"118\" alt=\"actual\"\nsrc=\"https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079\"\n/> |\n\n**A more real-life example**\n<img width=\"1661\" alt=\"more_real_life\"\nsrc=\"https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b\"\n/>\n\n\n## Solution\nSwitching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue. \nScreenshot showing the difference between `DiffMethod.WORDS` and\n`DiffMethod.WORDS_WITH_SPACE`:\n<img width=\"675\" alt=\"words_vs_words_with_space\"\nsrc=\"https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a\"\n/>\n\n## Other changes\n- Removed `DiffMethod.TRIMMED_LINES` since it's now\n[deprecated](kpdecker/jsdiff#486) in the `diff`\nlibrary and we are not using it anyways.\n- Stopped using the \"zip\" option since I believe it produces a less\nreadable diff, especially for cases when there's a different number of\nlines in the original value vs updated value.\n\n<details>\n<summary><strong>Screenshots: with and without \"zip\" (click to\nexpand)</strong></summary>\n<strong>With the \"zip\" option (how it was before)</strong>\n<img width=\"1918\" alt=\"zip\"\nsrc=\"https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e\"\n/>\n\n<strong>No \"zip\" (this branch)</strong>\n<img width=\"1919\" alt=\"no_zip\"\nsrc=\"https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956\"\n/>\n</details>\n\n## Testing\n\nI thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across various\ninputs and scenarios, including:\n- Single-line and multi-line strings.\n- Numbers, arrays, and objects.\n- Additions, deletions, and updates at different positions (start,\nmiddle, and end) within and across lines.\n\nI also validated diffs against real prebuilt rules by installing an\nolder Fleet package version and observed no issues.\n\nYou can test by trying different input strings and settings in\nStorybook.\n**Run Storybook**: `yarn storybook security_solution`.\n\n\nhttps://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e\n\nYou can notice that `ComparisonSide` stories are broken, but that's\nunrelated to these changes and needs to be handled separately.\n\n## Compatibility with future upgrades\n\nThere's an open [PR](#202622) that\nwill upgrade the `diff` library from v5 to v7. I verified the behavior\nof `DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences compared\nto v5, so it should be safe to upgrade to v7 without any changes on our\nend.\n\nWork started on 23-Dec-2024.","sha":"140c2e0ecf9f8a0277699052f9ba472066a0e96d","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Detections and Resp","Team: SecuritySolution","Feature:Rule Management","Team:Detection Rule Management","Feature:Prebuilt Detection Rules","backport:version","v8.18.0"],"number":205138,"url":"https://github.com/elastic/kibana/pull/205138","mergeCommit":{"message":"[Security Solution] Fix incorrect changes highlighting in diff view (#205138)\n\n**Resolves: https://github.com/elastic/kibana/issues/202016**\n\n## Summary\n\nThis PR resolves an issue where the diff view incorrectly marked certain\ncharacters as changed (using bold font) in some cases.\n\n## Root Cause\nThe issue arises from a bug in the `diff` library (v5). The library is\nused to compute two-way diffs between strings (old field value and new\nfield value), producing an array of change objects that is then used for\nrendering.\n\nConditions for the bug:\n- `diff` v5 library is in use (fixed in v6 and above) and\n`DiffMethod.WORDS` is passed as a parameter to it.\n- The old field value contains a line with an addition separated by a\nspace (see example below).\n- The next line contains some changes (additions, deletions, or\nupdates).\n\n\nFor example, for these input strings:\n```\nfoo bar\nspring\n```\n```\nfoo\nsprint\n```\n\n| You would expect to see this diff | But you actually see this |\n|----------|----------|\n| <img width=\"119\" alt=\"expected\"\nsrc=\"https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247\"\n/> | <img width=\"118\" alt=\"actual\"\nsrc=\"https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079\"\n/> |\n\n**A more real-life example**\n<img width=\"1661\" alt=\"more_real_life\"\nsrc=\"https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b\"\n/>\n\n\n## Solution\nSwitching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue. \nScreenshot showing the difference between `DiffMethod.WORDS` and\n`DiffMethod.WORDS_WITH_SPACE`:\n<img width=\"675\" alt=\"words_vs_words_with_space\"\nsrc=\"https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a\"\n/>\n\n## Other changes\n- Removed `DiffMethod.TRIMMED_LINES` since it's now\n[deprecated](kpdecker/jsdiff#486) in the `diff`\nlibrary and we are not using it anyways.\n- Stopped using the \"zip\" option since I believe it produces a less\nreadable diff, especially for cases when there's a different number of\nlines in the original value vs updated value.\n\n<details>\n<summary><strong>Screenshots: with and without \"zip\" (click to\nexpand)</strong></summary>\n<strong>With the \"zip\" option (how it was before)</strong>\n<img width=\"1918\" alt=\"zip\"\nsrc=\"https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e\"\n/>\n\n<strong>No \"zip\" (this branch)</strong>\n<img width=\"1919\" alt=\"no_zip\"\nsrc=\"https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956\"\n/>\n</details>\n\n## Testing\n\nI thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across various\ninputs and scenarios, including:\n- Single-line and multi-line strings.\n- Numbers, arrays, and objects.\n- Additions, deletions, and updates at different positions (start,\nmiddle, and end) within and across lines.\n\nI also validated diffs against real prebuilt rules by installing an\nolder Fleet package version and observed no issues.\n\nYou can test by trying different input strings and settings in\nStorybook.\n**Run Storybook**: `yarn storybook security_solution`.\n\n\nhttps://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e\n\nYou can notice that `ComparisonSide` stories are broken, but that's\nunrelated to these changes and needs to be handled separately.\n\n## Compatibility with future upgrades\n\nThere's an open [PR](#202622) that\nwill upgrade the `diff` library from v5 to v7. I verified the behavior\nof `DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences compared\nto v5, so it should be safe to upgrade to v7 without any changes on our\nend.\n\nWork started on 23-Dec-2024.","sha":"140c2e0ecf9f8a0277699052f9ba472066a0e96d"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","labelRegex":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/205138","number":205138,"mergeCommit":{"message":"[Security Solution] Fix incorrect changes highlighting in diff view (#205138)\n\n**Resolves: https://github.com/elastic/kibana/issues/202016**\n\n## Summary\n\nThis PR resolves an issue where the diff view incorrectly marked certain\ncharacters as changed (using bold font) in some cases.\n\n## Root Cause\nThe issue arises from a bug in the `diff` library (v5). The library is\nused to compute two-way diffs between strings (old field value and new\nfield value), producing an array of change objects that is then used for\nrendering.\n\nConditions for the bug:\n- `diff` v5 library is in use (fixed in v6 and above) and\n`DiffMethod.WORDS` is passed as a parameter to it.\n- The old field value contains a line with an addition separated by a\nspace (see example below).\n- The next line contains some changes (additions, deletions, or\nupdates).\n\n\nFor example, for these input strings:\n```\nfoo bar\nspring\n```\n```\nfoo\nsprint\n```\n\n| You would expect to see this diff | But you actually see this |\n|----------|----------|\n| <img width=\"119\" alt=\"expected\"\nsrc=\"https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247\"\n/> | <img width=\"118\" alt=\"actual\"\nsrc=\"https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079\"\n/> |\n\n**A more real-life example**\n<img width=\"1661\" alt=\"more_real_life\"\nsrc=\"https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b\"\n/>\n\n\n## Solution\nSwitching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue. \nScreenshot showing the difference between `DiffMethod.WORDS` and\n`DiffMethod.WORDS_WITH_SPACE`:\n<img width=\"675\" alt=\"words_vs_words_with_space\"\nsrc=\"https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a\"\n/>\n\n## Other changes\n- Removed `DiffMethod.TRIMMED_LINES` since it's now\n[deprecated](kpdecker/jsdiff#486) in the `diff`\nlibrary and we are not using it anyways.\n- Stopped using the \"zip\" option since I believe it produces a less\nreadable diff, especially for cases when there's a different number of\nlines in the original value vs updated value.\n\n<details>\n<summary><strong>Screenshots: with and without \"zip\" (click to\nexpand)</strong></summary>\n<strong>With the \"zip\" option (how it was before)</strong>\n<img width=\"1918\" alt=\"zip\"\nsrc=\"https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e\"\n/>\n\n<strong>No \"zip\" (this branch)</strong>\n<img width=\"1919\" alt=\"no_zip\"\nsrc=\"https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956\"\n/>\n</details>\n\n## Testing\n\nI thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across various\ninputs and scenarios, including:\n- Single-line and multi-line strings.\n- Numbers, arrays, and objects.\n- Additions, deletions, and updates at different positions (start,\nmiddle, and end) within and across lines.\n\nI also validated diffs against real prebuilt rules by installing an\nolder Fleet package version and observed no issues.\n\nYou can test by trying different input strings and settings in\nStorybook.\n**Run Storybook**: `yarn storybook security_solution`.\n\n\nhttps://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e\n\nYou can notice that `ComparisonSide` stories are broken, but that's\nunrelated to these changes and needs to be handled separately.\n\n## Compatibility with future upgrades\n\nThere's an open [PR](#202622) that\nwill upgrade the `diff` library from v5 to v7. I verified the behavior\nof `DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences compared\nto v5, so it should be safe to upgrade to v7 without any changes on our\nend.\n\nWork started on 23-Dec-2024.","sha":"140c2e0ecf9f8a0277699052f9ba472066a0e96d"}},{"branch":"8.x","label":"v8.18.0","labelRegex":"^v8.18.0$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/205253","number":205253,"state":"MERGED","mergeCommit":{"sha":"2c736a7fcb9e8e8f209f1734562992b39fa2ebe7","message":"[8.x] [Security Solution] Fix incorrect changes highlighting in diff view (#205138) (#205253)\n\n# Backport\n\nThis will backport the following commits from `main` to `8.x`:\n- [[Security Solution] Fix incorrect changes highlighting in diff view\n(#205138)](https://github.com/elastic/kibana/pull/205138)\n\n<!--- Backport version: 9.4.3 -->\n\n### Questions ?\nPlease refer to the [Backport tool\ndocumentation](https://github.com/sqren/backport)\n\n<!--BACKPORT [{\"author\":{\"name\":\"Nikita\nIndik\",\"email\":\"nikita.indik@elastic.co\"},\"sourceCommit\":{\"committedDate\":\"2024-12-30T12:38:42Z\",\"message\":\"[Security\nSolution] Fix incorrect changes highlighting in diff view\n(#205138)\\n\\n**Resolves:\nhttps://github.com//issues/202016**\\n\\n## Summary\\n\\nThis\nPR resolves an issue where the diff view incorrectly marked\ncertain\\ncharacters as changed (using bold font) in some cases.\\n\\n##\nRoot Cause\\nThe issue arises from a bug in the `diff` library (v5). The\nlibrary is\\nused to compute two-way diffs between strings (old field\nvalue and new\\nfield value), producing an array of change objects that\nis then used for\\nrendering.\\n\\nConditions for the bug:\\n- `diff` v5\nlibrary is in use (fixed in v6 and above) and\\n`DiffMethod.WORDS` is\npassed as a parameter to it.\\n- The old field value contains a line with\nan addition separated by a\\nspace (see example below).\\n- The next line\ncontains some changes (additions, deletions, or\\nupdates).\\n\\n\\nFor\nexample, for these input strings:\\n```\\nfoo\nbar\\nspring\\n```\\n```\\nfoo\\nsprint\\n```\\n\\n| You would expect to see\nthis diff | But you actually see this |\\n|----------|----------|\\n| <img\nwidth=\\\"119\\\"\nalt=\\\"expected\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247\\\"\\n/>\n| <img width=\\\"118\\\"\nalt=\\\"actual\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079\\\"\\n/>\n|\\n\\n**A more real-life example**\\n<img width=\\\"1661\\\"\nalt=\\\"more_real_life\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b\\\"\\n/>\\n\\n\\n##\nSolution\\nSwitching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue.\n\\nScreenshot showing the difference between `DiffMethod.WORDS`\nand\\n`DiffMethod.WORDS_WITH_SPACE`:\\n<img width=\\\"675\\\"\nalt=\\\"words_vs_words_with_space\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a\\\"\\n/>\\n\\n##\nOther changes\\n- Removed `DiffMethod.TRIMMED_LINES` since it's\nnow\\n[deprecated](kpdecker/jsdiff#486) in the\n`diff`\\nlibrary and we are not using it anyways.\\n- Stopped using the\n\\\"zip\\\" option since I believe it produces a less\\nreadable diff,\nespecially for cases when there's a different number of\\nlines in the\noriginal value vs updated\nvalue.\\n\\n<details>\\n<summary><strong>Screenshots: with and without\n\\\"zip\\\" (click to\\nexpand)</strong></summary>\\n<strong>With the \\\"zip\\\"\noption (how it was before)</strong>\\n<img width=\\\"1918\\\"\nalt=\\\"zip\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e\\\"\\n/>\\n\\n<strong>No\n\\\"zip\\\" (this branch)</strong>\\n<img width=\\\"1919\\\"\nalt=\\\"no_zip\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956\\\"\\n/>\\n</details>\\n\\n##\nTesting\\n\\nI thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across\nvarious\\ninputs and scenarios, including:\\n- Single-line and multi-line\nstrings.\\n- Numbers, arrays, and objects.\\n- Additions, deletions, and\nupdates at different positions (start,\\nmiddle, and end) within and\nacross lines.\\n\\nI also validated diffs against real prebuilt rules by\ninstalling an\\nolder Fleet package version and observed no\nissues.\\n\\nYou can test by trying different input strings and settings\nin\\nStorybook.\\n**Run Storybook**: `yarn storybook\nsecurity_solution`.\\n\\n\\nhttps://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e\\n\\nYou\ncan notice that `ComparisonSide` stories are broken, but\nthat's\\nunrelated to these changes and needs to be handled\nseparately.\\n\\n## Compatibility with future upgrades\\n\\nThere's an open\n[PR](#202622) that\\nwill upgrade\nthe `diff` library from v5 to v7. I verified the behavior\\nof\n`DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences\ncompared\\nto v5, so it should be safe to upgrade to v7 without any\nchanges on our\\nend.\\n\\nWork started on\n23-Dec-2024.\",\"sha\":\"140c2e0ecf9f8a0277699052f9ba472066a0e96d\",\"branchLabelMapping\":{\"^v9.0.0$\":\"main\",\"^v8.18.0$\":\"8.x\",\"^v(\\\\d+).(\\\\d+).\\\\d+$\":\"$1.$2\"}},\"sourcePullRequest\":{\"labels\":[\"release_note:skip\",\"v9.0.0\",\"Team:Detections\nand Resp\",\"Team: SecuritySolution\",\"Feature:Rule\nManagement\",\"Team:Detection Rule Management\",\"Feature:Prebuilt Detection\nRules\",\"backport:version\",\"v8.18.0\"],\"title\":\"[Security Solution] Fix\nincorrect changes highlighting in diff\nview\",\"number\":205138,\"url\":\"https://github.com/elastic/kibana/pull/205138\",\"mergeCommit\":{\"message\":\"[Security\nSolution] Fix incorrect changes highlighting in diff view\n(#205138)\\n\\n**Resolves:\nhttps://github.com//issues/202016**\\n\\n## Summary\\n\\nThis\nPR resolves an issue where the diff view incorrectly marked\ncertain\\ncharacters as changed (using bold font) in some cases.\\n\\n##\nRoot Cause\\nThe issue arises from a bug in the `diff` library (v5). The\nlibrary is\\nused to compute two-way diffs between strings (old field\nvalue and new\\nfield value), producing an array of change objects that\nis then used for\\nrendering.\\n\\nConditions for the bug:\\n- `diff` v5\nlibrary is in use (fixed in v6 and above) and\\n`DiffMethod.WORDS` is\npassed as a parameter to it.\\n- The old field value contains a line with\nan addition separated by a\\nspace (see example below).\\n- The next line\ncontains some changes (additions, deletions, or\\nupdates).\\n\\n\\nFor\nexample, for these input strings:\\n```\\nfoo\nbar\\nspring\\n```\\n```\\nfoo\\nsprint\\n```\\n\\n| You would expect to see\nthis diff | But you actually see this |\\n|----------|----------|\\n| <img\nwidth=\\\"119\\\"\nalt=\\\"expected\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247\\\"\\n/>\n| <img width=\\\"118\\\"\nalt=\\\"actual\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079\\\"\\n/>\n|\\n\\n**A more real-life example**\\n<img width=\\\"1661\\\"\nalt=\\\"more_real_life\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b\\\"\\n/>\\n\\n\\n##\nSolution\\nSwitching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue.\n\\nScreenshot showing the difference between `DiffMethod.WORDS`\nand\\n`DiffMethod.WORDS_WITH_SPACE`:\\n<img width=\\\"675\\\"\nalt=\\\"words_vs_words_with_space\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a\\\"\\n/>\\n\\n##\nOther changes\\n- Removed `DiffMethod.TRIMMED_LINES` since it's\nnow\\n[deprecated](kpdecker/jsdiff#486) in the\n`diff`\\nlibrary and we are not using it anyways.\\n- Stopped using the\n\\\"zip\\\" option since I believe it produces a less\\nreadable diff,\nespecially for cases when there's a different number of\\nlines in the\noriginal value vs updated\nvalue.\\n\\n<details>\\n<summary><strong>Screenshots: with and without\n\\\"zip\\\" (click to\\nexpand)</strong></summary>\\n<strong>With the \\\"zip\\\"\noption (how it was before)</strong>\\n<img width=\\\"1918\\\"\nalt=\\\"zip\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e\\\"\\n/>\\n\\n<strong>No\n\\\"zip\\\" (this branch)</strong>\\n<img width=\\\"1919\\\"\nalt=\\\"no_zip\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956\\\"\\n/>\\n</details>\\n\\n##\nTesting\\n\\nI thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across\nvarious\\ninputs and scenarios, including:\\n- Single-line and multi-line\nstrings.\\n- Numbers, arrays, and objects.\\n- Additions, deletions, and\nupdates at different positions (start,\\nmiddle, and end) within and\nacross lines.\\n\\nI also validated diffs against real prebuilt rules by\ninstalling an\\nolder Fleet package version and observed no\nissues.\\n\\nYou can test by trying different input strings and settings\nin\\nStorybook.\\n**Run Storybook**: `yarn storybook\nsecurity_solution`.\\n\\n\\nhttps://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e\\n\\nYou\ncan notice that `ComparisonSide` stories are broken, but\nthat's\\nunrelated to these changes and needs to be handled\nseparately.\\n\\n## Compatibility with future upgrades\\n\\nThere's an open\n[PR](#202622) that\\nwill upgrade\nthe `diff` library from v5 to v7. I verified the behavior\\nof\n`DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences\ncompared\\nto v5, so it should be safe to upgrade to v7 without any\nchanges on our\\nend.\\n\\nWork started on\n23-Dec-2024.\",\"sha\":\"140c2e0ecf9f8a0277699052f9ba472066a0e96d\"}},\"sourceBranch\":\"main\",\"suggestedTargetBranches\":[\"8.x\"],\"targetPullRequestStates\":[{\"branch\":\"main\",\"label\":\"v9.0.0\",\"branchLabelMappingKey\":\"^v9.0.0$\",\"isSourceBranch\":true,\"state\":\"MERGED\",\"url\":\"https://github.com/elastic/kibana/pull/205138\",\"number\":205138,\"mergeCommit\":{\"message\":\"[Security\nSolution] Fix incorrect changes highlighting in diff view\n(#205138)\\n\\n**Resolves:\nhttps://github.com//issues/202016**\\n\\n## Summary\\n\\nThis\nPR resolves an issue where the diff view incorrectly marked\ncertain\\ncharacters as changed (using bold font) in some cases.\\n\\n##\nRoot Cause\\nThe issue arises from a bug in the `diff` library (v5). The\nlibrary is\\nused to compute two-way diffs between strings (old field\nvalue and new\\nfield value), producing an array of change objects that\nis then used for\\nrendering.\\n\\nConditions for the bug:\\n- `diff` v5\nlibrary is in use (fixed in v6 and above) and\\n`DiffMethod.WORDS` is\npassed as a parameter to it.\\n- The old field value contains a line with\nan addition separated by a\\nspace (see example below).\\n- The next line\ncontains some changes (additions, deletions, or\\nupdates).\\n\\n\\nFor\nexample, for these input strings:\\n```\\nfoo\nbar\\nspring\\n```\\n```\\nfoo\\nsprint\\n```\\n\\n| You would expect to see\nthis diff | But you actually see this |\\n|----------|----------|\\n| <img\nwidth=\\\"119\\\"\nalt=\\\"expected\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247\\\"\\n/>\n| <img width=\\\"118\\\"\nalt=\\\"actual\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079\\\"\\n/>\n|\\n\\n**A more real-life example**\\n<img width=\\\"1661\\\"\nalt=\\\"more_real_life\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b\\\"\\n/>\\n\\n\\n##\nSolution\\nSwitching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue.\n\\nScreenshot showing the difference between `DiffMethod.WORDS`\nand\\n`DiffMethod.WORDS_WITH_SPACE`:\\n<img width=\\\"675\\\"\nalt=\\\"words_vs_words_with_space\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a\\\"\\n/>\\n\\n##\nOther changes\\n- Removed `DiffMethod.TRIMMED_LINES` since it's\nnow\\n[deprecated](kpdecker/jsdiff#486) in the\n`diff`\\nlibrary and we are not using it anyways.\\n- Stopped using the\n\\\"zip\\\" option since I believe it produces a less\\nreadable diff,\nespecially for cases when there's a different number of\\nlines in the\noriginal value vs updated\nvalue.\\n\\n<details>\\n<summary><strong>Screenshots: with and without\n\\\"zip\\\" (click to\\nexpand)</strong></summary>\\n<strong>With the \\\"zip\\\"\noption (how it was before)</strong>\\n<img width=\\\"1918\\\"\nalt=\\\"zip\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e\\\"\\n/>\\n\\n<strong>No\n\\\"zip\\\" (this branch)</strong>\\n<img width=\\\"1919\\\"\nalt=\\\"no_zip\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956\\\"\\n/>\\n</details>\\n\\n##\nTesting\\n\\nI thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across\nvarious\\ninputs and scenarios, including:\\n- Single-line and multi-line\nstrings.\\n- Numbers, arrays, and objects.\\n- Additions, deletions, and\nupdates at different positions (start,\\nmiddle, and end) within and\nacross lines.\\n\\nI also validated diffs against real prebuilt rules by\ninstalling an\\nolder Fleet package version and observed no\nissues.\\n\\nYou can test by trying different input strings and settings\nin\\nStorybook.\\n**Run Storybook**: `yarn storybook\nsecurity_solution`.\\n\\n\\nhttps://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e\\n\\nYou\ncan notice that `ComparisonSide` stories are broken, but\nthat's\\nunrelated to these changes and needs to be handled\nseparately.\\n\\n## Compatibility with future upgrades\\n\\nThere's an open\n[PR](#202622) that\\nwill upgrade\nthe `diff` library from v5 to v7. I verified the behavior\\nof\n`DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences\ncompared\\nto v5, so it should be safe to upgrade to v7 without any\nchanges on our\\nend.\\n\\nWork started on\n23-Dec-2024.\",\"sha\":\"140c2e0ecf9f8a0277699052f9ba472066a0e96d\"}},{\"branch\":\"8.x\",\"label\":\"v8.18.0\",\"branchLabelMappingKey\":\"^v8.18.0$\",\"isSourceBranch\":false,\"state\":\"NOT_CREATED\"}]}]\nBACKPORT-->\n\nCo-authored-by: Nikita Indik <nikita.indik@elastic.co>"}}]}] BACKPORT-->
nikitaindik
added a commit
that referenced
this issue
Jan 6, 2025
… view (#205138) (#205611) # Backport This will backport the following commits from `main` to `8.17`: - [[Security Solution] Fix incorrect changes highlighting in diff view (#205138)](#205138) <!--- Backport version: 8.9.8 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Nikita Indik","email":"nikita.indik@elastic.co"},"sourceCommit":{"committedDate":"2024-12-30T12:38:42Z","message":"[Security Solution] Fix incorrect changes highlighting in diff view (#205138)\n\n**Resolves: https://github.com/elastic/kibana/issues/202016**\n\n## Summary\n\nThis PR resolves an issue where the diff view incorrectly marked certain\ncharacters as changed (using bold font) in some cases.\n\n## Root Cause\nThe issue arises from a bug in the `diff` library (v5). The library is\nused to compute two-way diffs between strings (old field value and new\nfield value), producing an array of change objects that is then used for\nrendering.\n\nConditions for the bug:\n- `diff` v5 library is in use (fixed in v6 and above) and\n`DiffMethod.WORDS` is passed as a parameter to it.\n- The old field value contains a line with an addition separated by a\nspace (see example below).\n- The next line contains some changes (additions, deletions, or\nupdates).\n\n\nFor example, for these input strings:\n```\nfoo bar\nspring\n```\n```\nfoo\nsprint\n```\n\n| You would expect to see this diff | But you actually see this |\n|----------|----------|\n| <img width=\"119\" alt=\"expected\"\nsrc=\"https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247\"\n/> | <img width=\"118\" alt=\"actual\"\nsrc=\"https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079\"\n/> |\n\n**A more real-life example**\n<img width=\"1661\" alt=\"more_real_life\"\nsrc=\"https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b\"\n/>\n\n\n## Solution\nSwitching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue. \nScreenshot showing the difference between `DiffMethod.WORDS` and\n`DiffMethod.WORDS_WITH_SPACE`:\n<img width=\"675\" alt=\"words_vs_words_with_space\"\nsrc=\"https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a\"\n/>\n\n## Other changes\n- Removed `DiffMethod.TRIMMED_LINES` since it's now\n[deprecated](kpdecker/jsdiff#486) in the `diff`\nlibrary and we are not using it anyways.\n- Stopped using the \"zip\" option since I believe it produces a less\nreadable diff, especially for cases when there's a different number of\nlines in the original value vs updated value.\n\n<details>\n<summary><strong>Screenshots: with and without \"zip\" (click to\nexpand)</strong></summary>\n<strong>With the \"zip\" option (how it was before)</strong>\n<img width=\"1918\" alt=\"zip\"\nsrc=\"https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e\"\n/>\n\n<strong>No \"zip\" (this branch)</strong>\n<img width=\"1919\" alt=\"no_zip\"\nsrc=\"https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956\"\n/>\n</details>\n\n## Testing\n\nI thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across various\ninputs and scenarios, including:\n- Single-line and multi-line strings.\n- Numbers, arrays, and objects.\n- Additions, deletions, and updates at different positions (start,\nmiddle, and end) within and across lines.\n\nI also validated diffs against real prebuilt rules by installing an\nolder Fleet package version and observed no issues.\n\nYou can test by trying different input strings and settings in\nStorybook.\n**Run Storybook**: `yarn storybook security_solution`.\n\n\nhttps://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e\n\nYou can notice that `ComparisonSide` stories are broken, but that's\nunrelated to these changes and needs to be handled separately.\n\n## Compatibility with future upgrades\n\nThere's an open [PR](#202622) that\nwill upgrade the `diff` library from v5 to v7. I verified the behavior\nof `DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences compared\nto v5, so it should be safe to upgrade to v7 without any changes on our\nend.\n\nWork started on 23-Dec-2024.","sha":"140c2e0ecf9f8a0277699052f9ba472066a0e96d","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Detections and Resp","Team: SecuritySolution","Feature:Rule Management","Team:Detection Rule Management","Feature:Prebuilt Detection Rules","backport:version","v8.18.0"],"number":205138,"url":"https://github.com/elastic/kibana/pull/205138","mergeCommit":{"message":"[Security Solution] Fix incorrect changes highlighting in diff view (#205138)\n\n**Resolves: https://github.com/elastic/kibana/issues/202016**\n\n## Summary\n\nThis PR resolves an issue where the diff view incorrectly marked certain\ncharacters as changed (using bold font) in some cases.\n\n## Root Cause\nThe issue arises from a bug in the `diff` library (v5). The library is\nused to compute two-way diffs between strings (old field value and new\nfield value), producing an array of change objects that is then used for\nrendering.\n\nConditions for the bug:\n- `diff` v5 library is in use (fixed in v6 and above) and\n`DiffMethod.WORDS` is passed as a parameter to it.\n- The old field value contains a line with an addition separated by a\nspace (see example below).\n- The next line contains some changes (additions, deletions, or\nupdates).\n\n\nFor example, for these input strings:\n```\nfoo bar\nspring\n```\n```\nfoo\nsprint\n```\n\n| You would expect to see this diff | But you actually see this |\n|----------|----------|\n| <img width=\"119\" alt=\"expected\"\nsrc=\"https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247\"\n/> | <img width=\"118\" alt=\"actual\"\nsrc=\"https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079\"\n/> |\n\n**A more real-life example**\n<img width=\"1661\" alt=\"more_real_life\"\nsrc=\"https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b\"\n/>\n\n\n## Solution\nSwitching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue. \nScreenshot showing the difference between `DiffMethod.WORDS` and\n`DiffMethod.WORDS_WITH_SPACE`:\n<img width=\"675\" alt=\"words_vs_words_with_space\"\nsrc=\"https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a\"\n/>\n\n## Other changes\n- Removed `DiffMethod.TRIMMED_LINES` since it's now\n[deprecated](kpdecker/jsdiff#486) in the `diff`\nlibrary and we are not using it anyways.\n- Stopped using the \"zip\" option since I believe it produces a less\nreadable diff, especially for cases when there's a different number of\nlines in the original value vs updated value.\n\n<details>\n<summary><strong>Screenshots: with and without \"zip\" (click to\nexpand)</strong></summary>\n<strong>With the \"zip\" option (how it was before)</strong>\n<img width=\"1918\" alt=\"zip\"\nsrc=\"https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e\"\n/>\n\n<strong>No \"zip\" (this branch)</strong>\n<img width=\"1919\" alt=\"no_zip\"\nsrc=\"https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956\"\n/>\n</details>\n\n## Testing\n\nI thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across various\ninputs and scenarios, including:\n- Single-line and multi-line strings.\n- Numbers, arrays, and objects.\n- Additions, deletions, and updates at different positions (start,\nmiddle, and end) within and across lines.\n\nI also validated diffs against real prebuilt rules by installing an\nolder Fleet package version and observed no issues.\n\nYou can test by trying different input strings and settings in\nStorybook.\n**Run Storybook**: `yarn storybook security_solution`.\n\n\nhttps://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e\n\nYou can notice that `ComparisonSide` stories are broken, but that's\nunrelated to these changes and needs to be handled separately.\n\n## Compatibility with future upgrades\n\nThere's an open [PR](#202622) that\nwill upgrade the `diff` library from v5 to v7. I verified the behavior\nof `DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences compared\nto v5, so it should be safe to upgrade to v7 without any changes on our\nend.\n\nWork started on 23-Dec-2024.","sha":"140c2e0ecf9f8a0277699052f9ba472066a0e96d"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","labelRegex":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/205138","number":205138,"mergeCommit":{"message":"[Security Solution] Fix incorrect changes highlighting in diff view (#205138)\n\n**Resolves: https://github.com/elastic/kibana/issues/202016**\n\n## Summary\n\nThis PR resolves an issue where the diff view incorrectly marked certain\ncharacters as changed (using bold font) in some cases.\n\n## Root Cause\nThe issue arises from a bug in the `diff` library (v5). The library is\nused to compute two-way diffs between strings (old field value and new\nfield value), producing an array of change objects that is then used for\nrendering.\n\nConditions for the bug:\n- `diff` v5 library is in use (fixed in v6 and above) and\n`DiffMethod.WORDS` is passed as a parameter to it.\n- The old field value contains a line with an addition separated by a\nspace (see example below).\n- The next line contains some changes (additions, deletions, or\nupdates).\n\n\nFor example, for these input strings:\n```\nfoo bar\nspring\n```\n```\nfoo\nsprint\n```\n\n| You would expect to see this diff | But you actually see this |\n|----------|----------|\n| <img width=\"119\" alt=\"expected\"\nsrc=\"https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247\"\n/> | <img width=\"118\" alt=\"actual\"\nsrc=\"https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079\"\n/> |\n\n**A more real-life example**\n<img width=\"1661\" alt=\"more_real_life\"\nsrc=\"https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b\"\n/>\n\n\n## Solution\nSwitching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue. \nScreenshot showing the difference between `DiffMethod.WORDS` and\n`DiffMethod.WORDS_WITH_SPACE`:\n<img width=\"675\" alt=\"words_vs_words_with_space\"\nsrc=\"https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a\"\n/>\n\n## Other changes\n- Removed `DiffMethod.TRIMMED_LINES` since it's now\n[deprecated](kpdecker/jsdiff#486) in the `diff`\nlibrary and we are not using it anyways.\n- Stopped using the \"zip\" option since I believe it produces a less\nreadable diff, especially for cases when there's a different number of\nlines in the original value vs updated value.\n\n<details>\n<summary><strong>Screenshots: with and without \"zip\" (click to\nexpand)</strong></summary>\n<strong>With the \"zip\" option (how it was before)</strong>\n<img width=\"1918\" alt=\"zip\"\nsrc=\"https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e\"\n/>\n\n<strong>No \"zip\" (this branch)</strong>\n<img width=\"1919\" alt=\"no_zip\"\nsrc=\"https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956\"\n/>\n</details>\n\n## Testing\n\nI thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across various\ninputs and scenarios, including:\n- Single-line and multi-line strings.\n- Numbers, arrays, and objects.\n- Additions, deletions, and updates at different positions (start,\nmiddle, and end) within and across lines.\n\nI also validated diffs against real prebuilt rules by installing an\nolder Fleet package version and observed no issues.\n\nYou can test by trying different input strings and settings in\nStorybook.\n**Run Storybook**: `yarn storybook security_solution`.\n\n\nhttps://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e\n\nYou can notice that `ComparisonSide` stories are broken, but that's\nunrelated to these changes and needs to be handled separately.\n\n## Compatibility with future upgrades\n\nThere's an open [PR](#202622) that\nwill upgrade the `diff` library from v5 to v7. I verified the behavior\nof `DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences compared\nto v5, so it should be safe to upgrade to v7 without any changes on our\nend.\n\nWork started on 23-Dec-2024.","sha":"140c2e0ecf9f8a0277699052f9ba472066a0e96d"}},{"branch":"8.x","label":"v8.18.0","labelRegex":"^v8.18.0$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/205253","number":205253,"state":"MERGED","mergeCommit":{"sha":"2c736a7fcb9e8e8f209f1734562992b39fa2ebe7","message":"[8.x] [Security Solution] Fix incorrect changes highlighting in diff view (#205138) (#205253)\n\n# Backport\n\nThis will backport the following commits from `main` to `8.x`:\n- [[Security Solution] Fix incorrect changes highlighting in diff view\n(#205138)](https://github.com/elastic/kibana/pull/205138)\n\n<!--- Backport version: 9.4.3 -->\n\n### Questions ?\nPlease refer to the [Backport tool\ndocumentation](https://github.com/sqren/backport)\n\n<!--BACKPORT [{\"author\":{\"name\":\"Nikita\nIndik\",\"email\":\"nikita.indik@elastic.co\"},\"sourceCommit\":{\"committedDate\":\"2024-12-30T12:38:42Z\",\"message\":\"[Security\nSolution] Fix incorrect changes highlighting in diff view\n(#205138)\\n\\n**Resolves:\nhttps://github.com//issues/202016**\\n\\n## Summary\\n\\nThis\nPR resolves an issue where the diff view incorrectly marked\ncertain\\ncharacters as changed (using bold font) in some cases.\\n\\n##\nRoot Cause\\nThe issue arises from a bug in the `diff` library (v5). The\nlibrary is\\nused to compute two-way diffs between strings (old field\nvalue and new\\nfield value), producing an array of change objects that\nis then used for\\nrendering.\\n\\nConditions for the bug:\\n- `diff` v5\nlibrary is in use (fixed in v6 and above) and\\n`DiffMethod.WORDS` is\npassed as a parameter to it.\\n- The old field value contains a line with\nan addition separated by a\\nspace (see example below).\\n- The next line\ncontains some changes (additions, deletions, or\\nupdates).\\n\\n\\nFor\nexample, for these input strings:\\n```\\nfoo\nbar\\nspring\\n```\\n```\\nfoo\\nsprint\\n```\\n\\n| You would expect to see\nthis diff | But you actually see this |\\n|----------|----------|\\n| <img\nwidth=\\\"119\\\"\nalt=\\\"expected\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247\\\"\\n/>\n| <img width=\\\"118\\\"\nalt=\\\"actual\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079\\\"\\n/>\n|\\n\\n**A more real-life example**\\n<img width=\\\"1661\\\"\nalt=\\\"more_real_life\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b\\\"\\n/>\\n\\n\\n##\nSolution\\nSwitching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue.\n\\nScreenshot showing the difference between `DiffMethod.WORDS`\nand\\n`DiffMethod.WORDS_WITH_SPACE`:\\n<img width=\\\"675\\\"\nalt=\\\"words_vs_words_with_space\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a\\\"\\n/>\\n\\n##\nOther changes\\n- Removed `DiffMethod.TRIMMED_LINES` since it's\nnow\\n[deprecated](kpdecker/jsdiff#486) in the\n`diff`\\nlibrary and we are not using it anyways.\\n- Stopped using the\n\\\"zip\\\" option since I believe it produces a less\\nreadable diff,\nespecially for cases when there's a different number of\\nlines in the\noriginal value vs updated\nvalue.\\n\\n<details>\\n<summary><strong>Screenshots: with and without\n\\\"zip\\\" (click to\\nexpand)</strong></summary>\\n<strong>With the \\\"zip\\\"\noption (how it was before)</strong>\\n<img width=\\\"1918\\\"\nalt=\\\"zip\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e\\\"\\n/>\\n\\n<strong>No\n\\\"zip\\\" (this branch)</strong>\\n<img width=\\\"1919\\\"\nalt=\\\"no_zip\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956\\\"\\n/>\\n</details>\\n\\n##\nTesting\\n\\nI thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across\nvarious\\ninputs and scenarios, including:\\n- Single-line and multi-line\nstrings.\\n- Numbers, arrays, and objects.\\n- Additions, deletions, and\nupdates at different positions (start,\\nmiddle, and end) within and\nacross lines.\\n\\nI also validated diffs against real prebuilt rules by\ninstalling an\\nolder Fleet package version and observed no\nissues.\\n\\nYou can test by trying different input strings and settings\nin\\nStorybook.\\n**Run Storybook**: `yarn storybook\nsecurity_solution`.\\n\\n\\nhttps://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e\\n\\nYou\ncan notice that `ComparisonSide` stories are broken, but\nthat's\\nunrelated to these changes and needs to be handled\nseparately.\\n\\n## Compatibility with future upgrades\\n\\nThere's an open\n[PR](#202622) that\\nwill upgrade\nthe `diff` library from v5 to v7. I verified the behavior\\nof\n`DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences\ncompared\\nto v5, so it should be safe to upgrade to v7 without any\nchanges on our\\nend.\\n\\nWork started on\n23-Dec-2024.\",\"sha\":\"140c2e0ecf9f8a0277699052f9ba472066a0e96d\",\"branchLabelMapping\":{\"^v9.0.0$\":\"main\",\"^v8.18.0$\":\"8.x\",\"^v(\\\\d+).(\\\\d+).\\\\d+$\":\"$1.$2\"}},\"sourcePullRequest\":{\"labels\":[\"release_note:skip\",\"v9.0.0\",\"Team:Detections\nand Resp\",\"Team: SecuritySolution\",\"Feature:Rule\nManagement\",\"Team:Detection Rule Management\",\"Feature:Prebuilt Detection\nRules\",\"backport:version\",\"v8.18.0\"],\"title\":\"[Security Solution] Fix\nincorrect changes highlighting in diff\nview\",\"number\":205138,\"url\":\"https://github.com/elastic/kibana/pull/205138\",\"mergeCommit\":{\"message\":\"[Security\nSolution] Fix incorrect changes highlighting in diff view\n(#205138)\\n\\n**Resolves:\nhttps://github.com//issues/202016**\\n\\n## Summary\\n\\nThis\nPR resolves an issue where the diff view incorrectly marked\ncertain\\ncharacters as changed (using bold font) in some cases.\\n\\n##\nRoot Cause\\nThe issue arises from a bug in the `diff` library (v5). The\nlibrary is\\nused to compute two-way diffs between strings (old field\nvalue and new\\nfield value), producing an array of change objects that\nis then used for\\nrendering.\\n\\nConditions for the bug:\\n- `diff` v5\nlibrary is in use (fixed in v6 and above) and\\n`DiffMethod.WORDS` is\npassed as a parameter to it.\\n- The old field value contains a line with\nan addition separated by a\\nspace (see example below).\\n- The next line\ncontains some changes (additions, deletions, or\\nupdates).\\n\\n\\nFor\nexample, for these input strings:\\n```\\nfoo\nbar\\nspring\\n```\\n```\\nfoo\\nsprint\\n```\\n\\n| You would expect to see\nthis diff | But you actually see this |\\n|----------|----------|\\n| <img\nwidth=\\\"119\\\"\nalt=\\\"expected\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247\\\"\\n/>\n| <img width=\\\"118\\\"\nalt=\\\"actual\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079\\\"\\n/>\n|\\n\\n**A more real-life example**\\n<img width=\\\"1661\\\"\nalt=\\\"more_real_life\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b\\\"\\n/>\\n\\n\\n##\nSolution\\nSwitching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue.\n\\nScreenshot showing the difference between `DiffMethod.WORDS`\nand\\n`DiffMethod.WORDS_WITH_SPACE`:\\n<img width=\\\"675\\\"\nalt=\\\"words_vs_words_with_space\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a\\\"\\n/>\\n\\n##\nOther changes\\n- Removed `DiffMethod.TRIMMED_LINES` since it's\nnow\\n[deprecated](kpdecker/jsdiff#486) in the\n`diff`\\nlibrary and we are not using it anyways.\\n- Stopped using the\n\\\"zip\\\" option since I believe it produces a less\\nreadable diff,\nespecially for cases when there's a different number of\\nlines in the\noriginal value vs updated\nvalue.\\n\\n<details>\\n<summary><strong>Screenshots: with and without\n\\\"zip\\\" (click to\\nexpand)</strong></summary>\\n<strong>With the \\\"zip\\\"\noption (how it was before)</strong>\\n<img width=\\\"1918\\\"\nalt=\\\"zip\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e\\\"\\n/>\\n\\n<strong>No\n\\\"zip\\\" (this branch)</strong>\\n<img width=\\\"1919\\\"\nalt=\\\"no_zip\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956\\\"\\n/>\\n</details>\\n\\n##\nTesting\\n\\nI thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across\nvarious\\ninputs and scenarios, including:\\n- Single-line and multi-line\nstrings.\\n- Numbers, arrays, and objects.\\n- Additions, deletions, and\nupdates at different positions (start,\\nmiddle, and end) within and\nacross lines.\\n\\nI also validated diffs against real prebuilt rules by\ninstalling an\\nolder Fleet package version and observed no\nissues.\\n\\nYou can test by trying different input strings and settings\nin\\nStorybook.\\n**Run Storybook**: `yarn storybook\nsecurity_solution`.\\n\\n\\nhttps://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e\\n\\nYou\ncan notice that `ComparisonSide` stories are broken, but\nthat's\\nunrelated to these changes and needs to be handled\nseparately.\\n\\n## Compatibility with future upgrades\\n\\nThere's an open\n[PR](#202622) that\\nwill upgrade\nthe `diff` library from v5 to v7. I verified the behavior\\nof\n`DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences\ncompared\\nto v5, so it should be safe to upgrade to v7 without any\nchanges on our\\nend.\\n\\nWork started on\n23-Dec-2024.\",\"sha\":\"140c2e0ecf9f8a0277699052f9ba472066a0e96d\"}},\"sourceBranch\":\"main\",\"suggestedTargetBranches\":[\"8.x\"],\"targetPullRequestStates\":[{\"branch\":\"main\",\"label\":\"v9.0.0\",\"branchLabelMappingKey\":\"^v9.0.0$\",\"isSourceBranch\":true,\"state\":\"MERGED\",\"url\":\"https://github.com/elastic/kibana/pull/205138\",\"number\":205138,\"mergeCommit\":{\"message\":\"[Security\nSolution] Fix incorrect changes highlighting in diff view\n(#205138)\\n\\n**Resolves:\nhttps://github.com//issues/202016**\\n\\n## Summary\\n\\nThis\nPR resolves an issue where the diff view incorrectly marked\ncertain\\ncharacters as changed (using bold font) in some cases.\\n\\n##\nRoot Cause\\nThe issue arises from a bug in the `diff` library (v5). The\nlibrary is\\nused to compute two-way diffs between strings (old field\nvalue and new\\nfield value), producing an array of change objects that\nis then used for\\nrendering.\\n\\nConditions for the bug:\\n- `diff` v5\nlibrary is in use (fixed in v6 and above) and\\n`DiffMethod.WORDS` is\npassed as a parameter to it.\\n- The old field value contains a line with\nan addition separated by a\\nspace (see example below).\\n- The next line\ncontains some changes (additions, deletions, or\\nupdates).\\n\\n\\nFor\nexample, for these input strings:\\n```\\nfoo\nbar\\nspring\\n```\\n```\\nfoo\\nsprint\\n```\\n\\n| You would expect to see\nthis diff | But you actually see this |\\n|----------|----------|\\n| <img\nwidth=\\\"119\\\"\nalt=\\\"expected\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247\\\"\\n/>\n| <img width=\\\"118\\\"\nalt=\\\"actual\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079\\\"\\n/>\n|\\n\\n**A more real-life example**\\n<img width=\\\"1661\\\"\nalt=\\\"more_real_life\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b\\\"\\n/>\\n\\n\\n##\nSolution\\nSwitching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue.\n\\nScreenshot showing the difference between `DiffMethod.WORDS`\nand\\n`DiffMethod.WORDS_WITH_SPACE`:\\n<img width=\\\"675\\\"\nalt=\\\"words_vs_words_with_space\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a\\\"\\n/>\\n\\n##\nOther changes\\n- Removed `DiffMethod.TRIMMED_LINES` since it's\nnow\\n[deprecated](kpdecker/jsdiff#486) in the\n`diff`\\nlibrary and we are not using it anyways.\\n- Stopped using the\n\\\"zip\\\" option since I believe it produces a less\\nreadable diff,\nespecially for cases when there's a different number of\\nlines in the\noriginal value vs updated\nvalue.\\n\\n<details>\\n<summary><strong>Screenshots: with and without\n\\\"zip\\\" (click to\\nexpand)</strong></summary>\\n<strong>With the \\\"zip\\\"\noption (how it was before)</strong>\\n<img width=\\\"1918\\\"\nalt=\\\"zip\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e\\\"\\n/>\\n\\n<strong>No\n\\\"zip\\\" (this branch)</strong>\\n<img width=\\\"1919\\\"\nalt=\\\"no_zip\\\"\\nsrc=\\\"https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956\\\"\\n/>\\n</details>\\n\\n##\nTesting\\n\\nI thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across\nvarious\\ninputs and scenarios, including:\\n- Single-line and multi-line\nstrings.\\n- Numbers, arrays, and objects.\\n- Additions, deletions, and\nupdates at different positions (start,\\nmiddle, and end) within and\nacross lines.\\n\\nI also validated diffs against real prebuilt rules by\ninstalling an\\nolder Fleet package version and observed no\nissues.\\n\\nYou can test by trying different input strings and settings\nin\\nStorybook.\\n**Run Storybook**: `yarn storybook\nsecurity_solution`.\\n\\n\\nhttps://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e\\n\\nYou\ncan notice that `ComparisonSide` stories are broken, but\nthat's\\nunrelated to these changes and needs to be handled\nseparately.\\n\\n## Compatibility with future upgrades\\n\\nThere's an open\n[PR](#202622) that\\nwill upgrade\nthe `diff` library from v5 to v7. I verified the behavior\\nof\n`DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences\ncompared\\nto v5, so it should be safe to upgrade to v7 without any\nchanges on our\\nend.\\n\\nWork started on\n23-Dec-2024.\",\"sha\":\"140c2e0ecf9f8a0277699052f9ba472066a0e96d\"}},{\"branch\":\"8.x\",\"label\":\"v8.18.0\",\"branchLabelMappingKey\":\"^v8.18.0$\",\"isSourceBranch\":false,\"state\":\"NOT_CREATED\"}]}]\nBACKPORT-->\n\nCo-authored-by: Nikita Indik <nikita.indik@elastic.co>"}}]}] BACKPORT-->
CAWilson94
pushed a commit
to CAWilson94/kibana
that referenced
this issue
Jan 13, 2025
…lastic#205138) **Resolves: elastic#202016 ## Summary This PR resolves an issue where the diff view incorrectly marked certain characters as changed (using bold font) in some cases. ## Root Cause The issue arises from a bug in the `diff` library (v5). The library is used to compute two-way diffs between strings (old field value and new field value), producing an array of change objects that is then used for rendering. Conditions for the bug: - `diff` v5 library is in use (fixed in v6 and above) and `DiffMethod.WORDS` is passed as a parameter to it. - The old field value contains a line with an addition separated by a space (see example below). - The next line contains some changes (additions, deletions, or updates). For example, for these input strings: ``` foo bar spring ``` ``` foo sprint ``` | You would expect to see this diff | But you actually see this | |----------|----------| | <img width="119" alt="expected" src="https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247" /> | <img width="118" alt="actual" src="https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079" /> | **A more real-life example** <img width="1661" alt="more_real_life" src="https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b" /> ## Solution Switching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue. Screenshot showing the difference between `DiffMethod.WORDS` and `DiffMethod.WORDS_WITH_SPACE`: <img width="675" alt="words_vs_words_with_space" src="https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a" /> ## Other changes - Removed `DiffMethod.TRIMMED_LINES` since it's now [deprecated](kpdecker/jsdiff#486) in the `diff` library and we are not using it anyways. - Stopped using the "zip" option since I believe it produces a less readable diff, especially for cases when there's a different number of lines in the original value vs updated value. <details> <summary><strong>Screenshots: with and without "zip" (click to expand)</strong></summary> <strong>With the "zip" option (how it was before)</strong> <img width="1918" alt="zip" src="https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e" /> <strong>No "zip" (this branch)</strong> <img width="1919" alt="no_zip" src="https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956" /> </details> ## Testing I thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across various inputs and scenarios, including: - Single-line and multi-line strings. - Numbers, arrays, and objects. - Additions, deletions, and updates at different positions (start, middle, and end) within and across lines. I also validated diffs against real prebuilt rules by installing an older Fleet package version and observed no issues. You can test by trying different input strings and settings in Storybook. **Run Storybook**: `yarn storybook security_solution`. https://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e You can notice that `ComparisonSide` stories are broken, but that's unrelated to these changes and needs to be handled separately. ## Compatibility with future upgrades There's an open [PR](elastic#202622) that will upgrade the `diff` library from v5 to v7. I verified the behavior of `DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences compared to v5, so it should be safe to upgrade to v7 without any changes on our end. Work started on 23-Dec-2024.
viduni94
pushed a commit
to viduni94/kibana
that referenced
this issue
Jan 23, 2025
…lastic#205138) **Resolves: elastic#202016 ## Summary This PR resolves an issue where the diff view incorrectly marked certain characters as changed (using bold font) in some cases. ## Root Cause The issue arises from a bug in the `diff` library (v5). The library is used to compute two-way diffs between strings (old field value and new field value), producing an array of change objects that is then used for rendering. Conditions for the bug: - `diff` v5 library is in use (fixed in v6 and above) and `DiffMethod.WORDS` is passed as a parameter to it. - The old field value contains a line with an addition separated by a space (see example below). - The next line contains some changes (additions, deletions, or updates). For example, for these input strings: ``` foo bar spring ``` ``` foo sprint ``` | You would expect to see this diff | But you actually see this | |----------|----------| | <img width="119" alt="expected" src="https://github.com/user-attachments/assets/c41b3dec-e578-4a12-8eb8-91fbb60d7247" /> | <img width="118" alt="actual" src="https://github.com/user-attachments/assets/f2a33fee-5de2-4291-876a-e7575ea07079" /> | **A more real-life example** <img width="1661" alt="more_real_life" src="https://github.com/user-attachments/assets/91ebfe93-81ad-45c8-8f9b-e173c2cf940b" /> ## Solution Switching to `DiffMethod.WORDS_WITH_SPACE` avoids this issue. Screenshot showing the difference between `DiffMethod.WORDS` and `DiffMethod.WORDS_WITH_SPACE`: <img width="675" alt="words_vs_words_with_space" src="https://github.com/user-attachments/assets/3c91e1d2-63fc-4fcd-a762-a905878bfc3a" /> ## Other changes - Removed `DiffMethod.TRIMMED_LINES` since it's now [deprecated](kpdecker/jsdiff#486) in the `diff` library and we are not using it anyways. - Stopped using the "zip" option since I believe it produces a less readable diff, especially for cases when there's a different number of lines in the original value vs updated value. <details> <summary><strong>Screenshots: with and without "zip" (click to expand)</strong></summary> <strong>With the "zip" option (how it was before)</strong> <img width="1918" alt="zip" src="https://github.com/user-attachments/assets/272ed849-47d6-4fef-8acc-ab1b22c9f42e" /> <strong>No "zip" (this branch)</strong> <img width="1919" alt="no_zip" src="https://github.com/user-attachments/assets/417303bf-9570-4ee1-98c5-8a78f59c7956" /> </details> ## Testing I thoroughly tested with `DiffMethod.WORDS_WITH_SPACE` across various inputs and scenarios, including: - Single-line and multi-line strings. - Numbers, arrays, and objects. - Additions, deletions, and updates at different positions (start, middle, and end) within and across lines. I also validated diffs against real prebuilt rules by installing an older Fleet package version and observed no issues. You can test by trying different input strings and settings in Storybook. **Run Storybook**: `yarn storybook security_solution`. https://github.com/user-attachments/assets/0440b73c-a4d7-40cf-9cee-e632146d292e You can notice that `ComparisonSide` stories are broken, but that's unrelated to these changes and needs to be handled separately. ## Compatibility with future upgrades There's an open [PR](elastic#202622) that will upgrade the `diff` library from v5 to v7. I verified the behavior of `DiffMethod.WORDS_WITH_SPACE` on v7 and found no differences compared to v5, so it should be safe to upgrade to v7 without any changes on our end. Work started on 23-Dec-2024.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
PR: #205138
Summary
When upgrading rules, the diff view displays changes in the wrong places when comparing multiline strings.
Example
Here’s an example of the changes in the ESQL field:
The removed parts (in bold) are misplaced. For comparison, here’s how the same diff appears in an external diff tool:
The text was updated successfully, but these errors were encountered: