Skip to content
This repository has been archived by the owner on Aug 9, 2022. It is now read-only.

Improve server side input validation #128

Merged
merged 4 commits into from
Oct 20, 2020
Merged

Improve server side input validation #128

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d204e9c
improve input validation
zhongnansu Oct 19, 2020
77a4a11
clean up
zhongnansu Oct 19, 2020
751d61d
validate report name and email address
zhongnansu Oct 19, 2020
f5f3389
fix
zhongnansu Oct 20, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 25 additions & 17 deletions kibana-reports/public/components/context_menu/context_menu.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,19 +24,20 @@ import {
addSuccessOrFailureToast,
contextMenuViewReports,
} from './context_menu_helpers';
import { popoverMenu, popoverMenuDiscover, getMenuItem } from './context_menu_ui';
import {
popoverMenu,
popoverMenuDiscover,
getMenuItem,
} from './context_menu_ui';

const replaceQueryURL = () => {
let url = window.location.href;
let url = location.pathname + location.hash;
let timeString = url.substring(
url.lastIndexOf('time:'),
url.lastIndexOf('))')
);
if (url.includes("visualize") || url.includes("discover")) {
timeString = url.substring(
url.lastIndexOf("time:"),
url.indexOf("))")
);
if (url.includes('visualize') || url.includes('discover')) {
timeString = url.substring(url.lastIndexOf('time:'), url.indexOf('))'));
}

let fromDateString = timeString.substring(
Expand Down Expand Up @@ -68,18 +69,20 @@ const replaceQueryURL = () => {
return url;
};

const generateInContextReport = (timeRanges, queryUrl, fileFormat, rest = {}) => {
const generateInContextReport = (
timeRanges,
queryUrl,
fileFormat,
rest = {}
) => {
displayLoadingModal();
let baseUrl = window.location.href.substr(
0,
window.location.href.indexOf('?')
);
const baseUrl = queryUrl.substr(0, queryUrl.indexOf('?'));
let reportSource = '';
if (window.location.href.includes('dashboard')) {
if (baseUrl.includes('dashboard')) {
reportSource = 'Dashboard';
} else if (window.location.href.includes('visualize')) {
} else if (baseUrl.includes('visualize')) {
reportSource = 'Visualization';
} else if (window.location.href.includes('discover')) {
} else if (baseUrl.includes('discover')) {
reportSource = 'Saved search';
}

Expand Down Expand Up @@ -150,7 +153,9 @@ $(function () {
if (popoverScreen) {
try {
const reportPopover = document.createElement('div');
reportPopover.innerHTML = isDiscover() ? popoverMenuDiscover(getUuidFromUrl()) : popoverMenu();
reportPopover.innerHTML = isDiscover()
? popoverMenuDiscover(getUuidFromUrl())
: popoverMenu();
popoverScreen[0].appendChild(reportPopover.children[0]);
$('#reportPopover').show();
} catch (e) {
Expand Down Expand Up @@ -254,7 +259,10 @@ function locationHashChanged() {
}

// try to match uuid followed by '?' in URL, which would be the saved search id for discover URL
const getUuidFromUrl = () => window.location.href.match(/(\b[0-9a-f]{8}\b-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-\b[0-9a-f]{12}\b)\?/);
const getUuidFromUrl = () =>
window.location.href.match(
/(\b[0-9a-f]{8}\b-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-\b[0-9a-f]{12}\b)\?/
);
const isDiscover = () => window.location.href.includes('discover');

window.onhashchange = function () {
Expand Down
85 changes: 42 additions & 43 deletions kibana-reports/public/components/context_menu/context_menu_helpers.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,67 +18,63 @@ import moment from 'moment';
import {
reportGenerationInProgressModal,
reportGenerationSuccess,
reportGenerationFailure
reportGenerationFailure,
} from './context_menu_ui';

const getReportSourceURL = (baseURI) => {
let url = baseURI.substr(0, baseURI.indexOf("?"));
const reportSourceId = url.substr(url.lastIndexOf("/") + 1, url.length);
let url = baseURI.substr(0, baseURI.indexOf('?'));
const reportSourceId = url.substr(url.lastIndexOf('/') + 1, url.length);
return reportSourceId;
}
};

export const contextMenuCreateReportDefinition = (baseURI) => {
const reportSourceId = getReportSourceURL(baseURI);
let reportSource = "";
let reportSource = '';
let timeRanges = getTimeFieldsFromUrl();

// check report source
if (baseURI.includes('dashboard')) {
reportSource = 'dashboard:';
}
else if (baseURI.includes('visualize')) {
reportSource = 'visualize:'
}
else if (baseURI.includes('discover')) {
} else if (baseURI.includes('visualize')) {
reportSource = 'visualize:';
} else if (baseURI.includes('discover')) {
reportSource = 'discover:';
}
reportSource += reportSourceId.toString();
window.location.assign(
`opendistro_kibana_reports#/create?previous=${reportSource}?timeFrom=${timeRanges.time_from.toISOString()}?timeTo=${timeRanges.time_to.toISOString()}`
)
}
);
};

export const contextMenuViewReports = () => window.location.assign('opendistro_kibana_reports#/');
export const contextMenuViewReports = () =>
window.location.assign('opendistro_kibana_reports#/');

export const getTimeFieldsFromUrl = () => {
let url = window.location.href;
let timeString = url.substring(
url.lastIndexOf("time:"),
url.lastIndexOf("))")
);
if (url.includes("visualize") || url.includes("discover")) {
timeString = url.substring(
url.lastIndexOf("time:"),
url.indexOf("))")
);
url.lastIndexOf('time:'),
url.lastIndexOf('))')
);
if (url.includes('visualize') || url.includes('discover')) {
timeString = url.substring(url.lastIndexOf('time:'), url.indexOf('))'));
}

let fromDateString = timeString.substring(
timeString.lastIndexOf("from:") + 5,
timeString.lastIndexOf(",")
timeString.lastIndexOf('from:') + 5,
timeString.lastIndexOf(',')
);

// remove extra quotes if the 'from' date is absolute time
fromDateString = fromDateString.replace(/[']+/g, '');

// convert time range to from date format in case time range is relative
let fromDateFormat = dateMath.parse(fromDateString);

let toDateString = timeString.substring(
timeString.lastIndexOf("to:") + 3,
timeString.lastIndexOf('to:') + 3,
timeString.length
);

toDateString = toDateString.replace(/[']+/g, '');
let toDateFormat = dateMath.parse(toDateString);

Expand All @@ -89,39 +85,42 @@ export const getTimeFieldsFromUrl = () => {
return {
time_from: fromDateFormat,
time_to: toDateFormat,
time_duration: timeDuration.toISOString()
}
}
time_duration: timeDuration.toISOString(),
};
};

export const displayLoadingModal = () => {
const kibanaBody = document.getElementById("kibana-body");
const kibanaBody = document.getElementById('kibana-body');
if (kibanaBody) {
try {
const loadingModal = document.createElement("div");
const loadingModal = document.createElement('div');
loadingModal.innerHTML = reportGenerationInProgressModal();
kibanaBody.appendChild(loadingModal.children[0]);
} catch (e) {
console.log("error displaying loading modal:", e);
console.log('error displaying loading modal:', e);
}
}
}
};

export const addSuccessOrFailureToast = (status) => {
const generateToast = document.querySelectorAll(".euiGlobalToastList");
const generateToast = document.querySelectorAll('.euiGlobalToastList');
if (generateToast) {
try {
const generateInProgressToast = document.createElement("div");
if (status === "success") {
const generateInProgressToast = document.createElement('div');
if (status === 'success') {
generateInProgressToast.innerHTML = reportGenerationSuccess();
setTimeout(function () {document.getElementById('reportSuccessToast').style.display='none'}, 6000); // closes toast automatically after 6s
}
else if (status === "failure") {
setTimeout(function () {
document.getElementById('reportSuccessToast').style.display = 'none';
}, 6000); // closes toast automatically after 6s
} else if (status === 'failure') {
generateInProgressToast.innerHTML = reportGenerationFailure();
setTimeout(function () {document.getElementById('reportFailureToast').style.display='none'}, 6000);
setTimeout(function () {
document.getElementById('reportFailureToast').style.display = 'none';
}, 6000);
}
generateToast[0].appendChild(generateInProgressToast.children[0]);
} catch (e) {
console.log("error displaying toast", e);
console.log('error displaying toast', e);
}
}
}
};
4 changes: 2 additions & 2 deletions kibana-reports/public/components/main/main_utils.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ export const addReportsTableContent = (data) => {
//TODO: wrong name
timeCreated: report.time_created,
state: report.state,
url: report.query_url,
url: `${location.host}${report.query_url}`,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What does location.host add?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the query_url is now relative, need to add the host as well for the link rendered in report table -> report source field to be accessible.

format: reportParams.core_params.report_format,
};
reportsTableItems.push(reportsTableEntry);
Expand All @@ -85,7 +85,7 @@ export const addReportDefinitionsTableContent = (data: any) => {
type: trigger.trigger_type,
owner: `\u2014`, // Todo: replace
source: reportParams.report_source,
baseUrl: reportParams.core_params.base_url,
baseUrl: `${location.host}${reportParams.core_params.base_url}`,
lastUpdated: reportDefinition.last_updated,
details:
trigger.trigger_type === 'On demand'
Expand Down
2 changes: 1 addition & 1 deletion ...na-reports/public/components/main/report_definition_details/report_definition_details.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -283,7 +283,7 @@ export function ReportDefinitionDetails(props) {

const sourceURL = (data) => {
return (
<EuiLink href={data.baseUrl} target="_blank">
<EuiLink href={`${location.host}${data.baseUrl}`} target="_blank">
{data['source']}
</EuiLink>
);
Expand Down
2 changes: 1 addition & 1 deletion kibana-reports/public/components/main/report_details/report_details.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,7 +189,7 @@ export function ReportDetails(props) {

const sourceURL = (data) => {
return (
<EuiLink href={data.queryUrl} target="_blank">
<EuiLink href={`${location.host}${data.queryUrl}`} target="_blank">
{data['source']}
</EuiLink>
);
Expand Down
6 changes: 3 additions & 3 deletions ...-reports/public/components/report_definitions/report_settings/report_settings_helpers.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ export const getDashboardBaseUrlCreate = (
edit: boolean,
editDefinitionId: string
) => {
let baseUrl = window.location.href;
let baseUrl = location.pathname + location.hash;
if (edit) {
return baseUrl.replace(
`opendistro_kibana_reports#/edit/${editDefinitionId}`,
Expand All @@ -43,7 +43,7 @@ export const getDashboardBaseUrlCreate = (
};

export const getVisualizationBaseUrlCreate = (edit: boolean) => {
let baseUrl = window.location.href;
let baseUrl = location.pathname + location.hash;
if (edit) {
return baseUrl.replace(
'opendistro_kibana_reports#/edit',
Expand All @@ -57,7 +57,7 @@ export const getVisualizationBaseUrlCreate = (edit: boolean) => {
};

export const getSavedSearchBaseUrlCreate = (edit: boolean) => {
let baseUrl = window.location.href;
let baseUrl = location.pathname + location.hash;
if (edit) {
return baseUrl.replace(
'opendistro_kibana_reports#/edit',
Expand Down
Loading