[8.12] [EDR Workflows] [Osquery] Change query ID regex pattern (#176507)

x-pack/plugins/osquery/public/packs/queries/validations.test.ts

@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { idHookSchemaValidation } from './validations';
+
+describe('idSchemaValidation', () => {
+  it('returns undefined for valid id', () => {
+    expect(idHookSchemaValidation('valid-id')).toBeUndefined();
+  });
+  it('returns undefined for valid id with numbers', () => {
+    expect(idHookSchemaValidation('123valid_id_123')).toBeUndefined();
+  });
+  it('returns undefined for valid id with underscore _', () => {
+    expect(idHookSchemaValidation('valid_id')).toBeUndefined();
+  });
+  it('returns error message for invalid id with spaces', () => {
+    expect(idHookSchemaValidation('invalid id')).toEqual(
+      'Characters must be alphanumeric, _, or -'
+    );
+  });
+
+  it('returns error message for invalid id with dots', () => {
+    expect(idHookSchemaValidation('invalid.id')).toEqual(
+      'Characters must be alphanumeric, _, or -'
+    );
+  });
+
+  it('returns error message for invalid id with special characters', () => {
+    expect(idHookSchemaValidation('invalid@id')).toEqual(
+      'Characters must be alphanumeric, _, or -'
+    );
+  });
+  it('returns error message for invalid id just numbers', () => {
+    expect(idHookSchemaValidation('1232')).toEqual('Characters must be alphanumeric, _, or -');
+  });
+});

x-pack/plugins/osquery/public/packs/queries/validations.ts

@@ -9,7 +9,9 @@ import { i18n } from '@kbn/i18n';
 import type { FormData, ValidationFunc } from '../../shared_imports';
 
 export const MAX_QUERY_LENGTH = 2000;
-const idPattern = /^[a-zA-Z0-9-_]+$/;
+
+// Has to be a string, can't be just numbers, and cannot contain dot '.'
+const idPattern = /^(?![0-9]+$)[a-zA-Z0-9-_]+$/;
 // still used in Packs
 export const idSchemaValidation: ValidationFunc<FormData, string, string> = ({ value }) => {
   const valueIsValid = idPattern.test(value);