[alerting] Adds Action Type configuration support and whitelisting

x-pack/legacy/plugins/actions/README.md

@@ -23,6 +23,27 @@ action types.
 2. Create an action by using the RESTful API (see actions -> create action).
 3. Use alerts to execute actions or execute manually (see firing actions).
 
+## Kibana Actions Configuration
+Implemented under the [Actions Config](./server/actions_config.ts).
+
+### Configuration Options
+
+Built-In-Actions are configured using the _xpack.actions_ namespoace under _kibana.yml_, and have the following configuration options:
+
+| Namespaced Key                       | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                          | Type                  |
+| ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
+| _xpack.actions._**enabled**          | Feature toggle which enabled Actions in Kibana. Currently defaulted to false while Actions are experimental.                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | boolean               |
+| _xpack.actions._**WhitelistedHosts** | Which _hostnames_ are whitelisted for the Built-In-Action? This list should contain hostnames of every external service you wish to interact with using Webhooks, Email or any other built in Action. Note that you may use the string "\*" in place of a specific hostname to enable Kibana to target any URL, but keep in mind the potential use of such a feature to execute [SSRF](https://www.owasp.org/index.php/Server_Side_Request_Forgery) attacks from your server. | Array<String> |
+
+### Configuration Utilities
+
+This module provides a Utilities for interacting with the configuration.
+
+| Method                | Arguments                                          | Description                                                                                                                                                                                                                                                            | Return Type                                                                                                                                                                                                                   |
+| --------------------- | -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| isWhitelistedUri | _uri_: The URI you wish to validate is whitelisted | Validates whether the URI is whitelisted. This checkes the configuration and validates that the hostname of the URI is in the list of whitelisted Hosts and returns the Uri if it is whitelisted. If the configuration says that all URI's are whitelisted (using an "\*") then it will always return the Uri. | String \| NotWhitelistedError: Returns a the whitelisted URI as is (if it is whitelisted) or a NotWhitelistedError Error with an error message if it isn't whitelisted. |
+| isWhitelistedHostname | _hostname_: The Hostname you wish to validate is whitelisted | Validates whether the Hostname is whitelisted. This checkes the configuration and validates that the hostname is in the list of whitelisted Hosts and returns the Hostname if it is whitelisted. If the configuration says that all Hostnames are whitelisted (using an "\*") then it will always return the Hostname. | String \| NotWhitelistedError: Returns a the whitelisted URI as is (if it is whitelisted) or a NotWhitelistedError Error with an error message if it isn't whitelisted. |
+
 ## Action types
 
 ### Methods

x-pack/legacy/plugins/actions/index.ts

@@ -27,6 +27,13 @@ export function actions(kibana: any) {
       return Joi.object()
         .keys({
           enabled: Joi.boolean().default(false),
+          whitelistedHosts: Joi.alternatives()
+            .try(
+              Joi.array()
+                .items(Joi.string().hostname())
+                .sparse(false)
+            )
+            .default([]),
         })
         .default();
     },

x-pack/legacy/plugins/actions/server/actions_config.test.ts

@@ -0,0 +1,71 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  ActionsKibanaConfig,
+  getActionsConfigurationUtilities,
+  WhitelistedHosts,
+  NotWhitelistedError,
+} from './actions_config';
+
+describe('isWhitelistedUri', () => {
+  test('returns true when "any" hostnames are allowed', () => {
+    const config: ActionsKibanaConfig = {
+      enabled: false,
+      whitelistedHosts: [WhitelistedHosts.Any],
+    };
+    expect(
+      getActionsConfigurationUtilities(config).isWhitelistedUri('https://github.com/elastic/kibana')
+    ).toEqual('https://github.com/elastic/kibana');
+  });
+
+  test('returns a NotWhitelistedError when the hostname in the requested uri is not in the whitelist', () => {
+    const config: ActionsKibanaConfig = { enabled: false, whitelistedHosts: [] };
+    expect(
+      getActionsConfigurationUtilities(config).isWhitelistedUri('https://github.com/elastic/kibana')
+    ).toEqual(new NotWhitelistedError('target url not in whitelist'));
+  });
+
+  test('returns a NotWhitelistedError when the uri cannot be parsed as a valid URI', () => {
+    const config: ActionsKibanaConfig = { enabled: false, whitelistedHosts: [] };
+    expect(getActionsConfigurationUtilities(config).isWhitelistedUri('github.com/elastic')).toEqual(
+      new NotWhitelistedError('target url not in whitelist')
+    );
+  });
+
+  test('returns true when the hostname in the requested uri is in the whitelist', () => {
+    const config: ActionsKibanaConfig = { enabled: false, whitelistedHosts: ['github.com'] };
+    expect(
+      getActionsConfigurationUtilities(config).isWhitelistedUri('https://github.com/elastic/kibana')
+    ).toEqual('https://github.com/elastic/kibana');
+  });
+});
+
+describe('isWhitelistedHostname', () => {
+  test('returns true when "any" hostnames are allowed', () => {
+    const config: ActionsKibanaConfig = {
+      enabled: false,
+      whitelistedHosts: [WhitelistedHosts.Any],
+    };
+    expect(getActionsConfigurationUtilities(config).isWhitelistedHostname('github.com')).toEqual(
+      'github.com'
+    );
+  });
+
+  test('returns false when the hostname in the requested uri is not in the whitelist', () => {
+    const config: ActionsKibanaConfig = { enabled: false, whitelistedHosts: [] };
+    expect(getActionsConfigurationUtilities(config).isWhitelistedHostname('github.com')).toEqual(
+      new NotWhitelistedError('target url not in whitelist')
+    );
+  });
+
+  test('returns true when the hostname in the requested uri is in the whitelist', () => {
+    const config: ActionsKibanaConfig = { enabled: false, whitelistedHosts: ['github.com'] };
+    expect(getActionsConfigurationUtilities(config).isWhitelistedHostname('github.com')).toEqual(
+      'github.com'
+    );
+  });
+});

x-pack/legacy/plugins/actions/server/actions_config.ts

@@ -0,0 +1,71 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { tryCatch } from 'fp-ts/lib/Option';
+import { URL } from 'url';
+import { curry } from 'lodash';
+
+export enum WhitelistedHosts {
+  Any = '*',
+}
+
+export interface ActionsKibanaConfig {
+  enabled: boolean;
+  whitelistedHosts: string[];
+}
+
+export class NotWhitelistedError extends Error {
+  constructor(message: string) {
+    super(message); // 'Error' breaks prototype chain here
+    Object.setPrototypeOf(this, new.target.prototype); // restore prototype chain
+  }
+}
+
+export interface ActionsConfigurationUtilities {
+  isWhitelistedHostname: (hostname: string) => string | NotWhitelistedError;
+  isWhitelistedUri: (uri: string) => string | NotWhitelistedError;
+}
+
+const whitelistingErrorMessage = 'target url not in whitelist';
+const doesValueWhitelistAnyHostname = (whitelistedHostname: string): boolean =>
+  whitelistedHostname === WhitelistedHosts.Any;
+
+function isWhitelisted(
+  config: ActionsKibanaConfig,
+  hostname: string
+): string | NotWhitelistedError {
+  if (
+    Array.isArray(config.whitelistedHosts) &&
+    config.whitelistedHosts.find(
+      whitelistedHostname =>
+        doesValueWhitelistAnyHostname(whitelistedHostname) || whitelistedHostname === hostname
+    )
+  ) {
+    return hostname;
+  }
+  return new NotWhitelistedError(whitelistingErrorMessage);
+}
+export function getActionsConfigurationUtilities(
+  config: ActionsKibanaConfig
+): ActionsConfigurationUtilities {
+  const isWhitelistedHostname = curry(isWhitelisted)(config);
+  return {
+    isWhitelistedUri(uri: string): string | NotWhitelistedError {
+      return tryCatch(() => new URL(uri))
+        .map(url => url.hostname)
+        .map(hostname => {
+          const result = isWhitelistedHostname(hostname);
+          if (result instanceof NotWhitelistedError) {
+            return result;
+          } else {
+            return uri;
+          }
+        })
+        .getOrElse(new NotWhitelistedError(whitelistingErrorMessage));
+    },
+    isWhitelistedHostname,
+  };
+}

x-pack/legacy/plugins/actions/server/builtin_action_types/email.test.ts

@@ -9,6 +9,7 @@ jest.mock('./lib/send_email', () => ({
 }));
 
 import { ActionType, ActionTypeExecutorOptions } from '../types';
+import { ActionsConfigurationUtilities } from '../actions_config';
 import { ActionTypeRegistry } from '../action_type_registry';
 import { encryptedSavedObjectsMock } from '../../../encrypted_saved_objects/server/plugin.mock';
 import { taskManagerMock } from '../../../task_manager/task_manager.mock';
@@ -22,6 +23,10 @@ const sendEmailMock = sendEmail as jest.Mock;
 
 const ACTION_TYPE_ID = '.email';
 const NO_OP_FN = () => {};
+const MOCK_KIBANA_CONFIG = {
+  isWhitelistedUri: _ => _,
+  isWhitelistedHostname: _ => _,
+} as ActionsConfigurationUtilities;
 
 const services = {
   log: NO_OP_FN,
@@ -48,7 +53,7 @@ beforeAll(() => {
     getBasePath: jest.fn().mockReturnValue(undefined),
   });
 
-  registerBuiltInActionTypes(actionTypeRegistry);
+  registerBuiltInActionTypes(actionTypeRegistry, MOCK_KIBANA_CONFIG);
 
   actionType = actionTypeRegistry.get(ACTION_TYPE_ID);
 });

x-pack/legacy/plugins/actions/server/builtin_action_types/email.ts

@@ -97,17 +97,18 @@ function validateParams(paramsObject: any): string | void {
 }
 
 // action type definition
-
-export const actionType: ActionType = {
-  id: '.email',
-  name: 'email',
-  validate: {
-    config: ConfigSchema,
-    secrets: SecretsSchema,
-    params: ParamsSchema,
-  },
-  executor,
-};
+export function getActionType(): ActionType {
+  return {
+    id: '.email',
+    name: 'email',
+    validate: {
+      config: ConfigSchema,
+      secrets: SecretsSchema,
+      params: ParamsSchema,
+    },
+    executor,
+  };
+}
 
 // action executor
 

x-pack/legacy/plugins/actions/server/builtin_action_types/es_index.test.ts

@@ -9,6 +9,7 @@ jest.mock('./lib/send_email', () => ({
 }));
 
 import { ActionType, ActionTypeExecutorOptions } from '../types';
+import { ActionsConfigurationUtilities } from '../actions_config';
 import { ActionTypeRegistry } from '../action_type_registry';
 import { encryptedSavedObjectsMock } from '../../../encrypted_saved_objects/server/plugin.mock';
 import { taskManagerMock } from '../../../task_manager/task_manager.mock';
@@ -19,6 +20,10 @@ import { ActionParamsType, ActionTypeConfigType } from './es_index';
 
 const ACTION_TYPE_ID = '.index';
 const NO_OP_FN = () => {};
+const MOCK_KIBANA_CONFIG = {
+  isWhitelistedUri: _ => _,
+  isWhitelistedHostname: _ => _,
+} as ActionsConfigurationUtilities;
 
 const services = {
   log: NO_OP_FN,
@@ -45,7 +50,7 @@ beforeAll(() => {
     getBasePath: jest.fn().mockReturnValue(undefined),
   });
 
-  registerBuiltInActionTypes(actionTypeRegistry);
+  registerBuiltInActionTypes(actionTypeRegistry, MOCK_KIBANA_CONFIG);
 
   actionType = actionTypeRegistry.get(ACTION_TYPE_ID);
 });

x-pack/legacy/plugins/actions/server/builtin_action_types/es_index.ts

@@ -33,16 +33,17 @@ const ParamsSchema = schema.object({
 });
 
 // action type definition
-
-export const actionType: ActionType = {
-  id: '.index',
-  name: 'index',
-  validate: {
-    config: ConfigSchema,
-    params: ParamsSchema,
-  },
-  executor,
-};
+export function getActionType(): ActionType {
+  return {
+    id: '.index',
+    name: 'index',
+    validate: {
+      config: ConfigSchema,
+      params: ParamsSchema,
+    },
+    executor,
+  };
+}
 
 // action executor
 

x-pack/legacy/plugins/actions/server/builtin_action_types/index.ts

@@ -5,17 +5,23 @@
  */
 
 import { ActionTypeRegistry } from '../action_type_registry';
+import { ActionsConfigurationUtilities } from '../actions_config';
 
-import { actionType as serverLogActionType } from './server_log';
-import { actionType as slackActionType } from './slack';
-import { actionType as emailActionType } from './email';
-import { actionType as indexActionType } from './es_index';
-import { actionType as pagerDutyActionType } from './pagerduty';
+import { getActionType as getServerLogActionType } from './server_log';
+import { getActionType as getSlackActionType } from './slack';
+import { getActionType as getEmailActionType } from './email';
+import { getActionType as getIndexActionType } from './es_index';
+import { getActionType as getPagerDutyActionType } from './pagerduty';
+import { getActionType as getWebhookActionType } from './webhook';
 
-export function registerBuiltInActionTypes(actionTypeRegistry: ActionTypeRegistry) {
-  actionTypeRegistry.register(serverLogActionType);
-  actionTypeRegistry.register(slackActionType);
-  actionTypeRegistry.register(emailActionType);
-  actionTypeRegistry.register(indexActionType);
-  actionTypeRegistry.register(pagerDutyActionType);
+export function registerBuiltInActionTypes(
+  actionTypeRegistry: ActionTypeRegistry,
+  actionsConfigUtils: ActionsConfigurationUtilities
+) {
+  actionTypeRegistry.register(getServerLogActionType());
+  actionTypeRegistry.register(getSlackActionType());
+  actionTypeRegistry.register(getEmailActionType());
+  actionTypeRegistry.register(getIndexActionType());
+  actionTypeRegistry.register(getPagerDutyActionType());
+  actionTypeRegistry.register(getWebhookActionType(actionsConfigUtils));
 }

x-pack/legacy/plugins/actions/server/builtin_action_types/pagerduty.test.ts

@@ -9,6 +9,7 @@ jest.mock('./lib/post_pagerduty', () => ({
 }));
 
 import { ActionType, Services, ActionTypeExecutorOptions } from '../types';
+import { ActionsConfigurationUtilities } from '../actions_config';
 import { ActionTypeRegistry } from '../action_type_registry';
 import { taskManagerMock } from '../../../task_manager/task_manager.mock';
 import { encryptedSavedObjectsMock } from '../../../encrypted_saved_objects/server/plugin.mock';
@@ -21,6 +22,10 @@ const postPagerdutyMock = postPagerduty as jest.Mock;
 
 const ACTION_TYPE_ID = '.pagerduty';
 const NO_OP_FN = () => {};
+const MOCK_KIBANA_CONFIG = {
+  isWhitelistedUri: _ => _,
+  isWhitelistedHostname: _ => _,
+} as ActionsConfigurationUtilities;
 
 const services: Services = {
   log: NO_OP_FN,
@@ -46,7 +51,7 @@ beforeAll(() => {
     spaceIdToNamespace: jest.fn().mockReturnValue(undefined),
     getBasePath: jest.fn().mockReturnValue(undefined),
   });
-  registerBuiltInActionTypes(actionTypeRegistry);
+  registerBuiltInActionTypes(actionTypeRegistry, MOCK_KIBANA_CONFIG);
   actionType = actionTypeRegistry.get(ACTION_TYPE_ID);
 });
 

x-pack/legacy/plugins/actions/server/builtin_action_types/pagerduty.ts

@@ -84,17 +84,18 @@ function validateParams(paramsObject: any): string | void {
 }
 
 // action type definition
-
-export const actionType: ActionType = {
-  id: '.pagerduty',
-  name: 'pagerduty',
-  validate: {
-    config: ConfigSchema,
-    secrets: SecretsSchema,
-    params: ParamsSchema,
-  },
-  executor,
-};
+export function getActionType(): ActionType {
+  return {
+    id: '.pagerduty',
+    name: 'pagerduty',
+    validate: {
+      config: ConfigSchema,
+      secrets: SecretsSchema,
+      params: ParamsSchema,
+    },
+    executor,
+  };
+}
 
 // action executor