[Security Solution] Error "Minified React error" occurred when search blocklist entry with comma(" , ") symbol

[ghost]

Description: Error "Minified React error" occurred when search blocklist entry with comma(" , ") symbol

Build Details:

VERSION: 8.4.0
BUILD: 54789
COMMIT: af3a3cba9a7fa3b3e0d2e4766a1db11a5ff4f192
ARTIFACT PAGE: https://artifacts-api.elastic.co/v1/search/8.4.0-SNAPSHOT

Browser Details: All

Preconditions:

1. Kibana user should be logged in
2. Blocklist entry should be available with name include comma(" , ") symbol let say : wvvwihqv,,

Steps to Reproduce:

1. Click on the "Manage" link from the L.H.S menu section and navigate to the "Endpoints" page.
2. Go to blocklist page.
3. Search blocklist entry with comma symbol i.e (" , ")
4. Observe that error "Minified React error" occurred.

Actual Result: Error "Minified React error" occurred when search blocklist entry with comma(" , ") symbol

Expected Result: No error occurred instead user should able to search blocklist entry with comma symbol.

What's Working

• Blocklist entry search successfully when search without comma symbol.

What's Not Working

• This issue is also occurring on other manage page i.e Trusted applications, Event filters and Host isolation exceptions.

ScreenCast

https://user-images.githubusercontent.com/69579402/180731670-34f094d7-22c9-4e64-bcab-6582ab430aa4.mp4

Logs: N/A

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-onboarding-and-lifecycle-mgt (Team:Onboarding and Lifecycle Mgt)

[ghost]

@manishgupta-qasource : Please review the bug.

[manishgupta-qasource]

Reviewed & assigned to @kevinlog

[kevinlog]

@dasansol92 could you take a look? My guess is that this affects most of the artifact pages

[dasansol92]

@kevinlog Yes, it is related to the api request we do for getting the exception items in all of our artifact list pages. Seems KQL syntax does not allow colons or semi colons.

[dasansol92]

PR: https://github.com/elastic/kibana/pull/137415

[ghost]

Hi @dasansol92

We have validate this issue on v8.5.0-Snapshot build and found that issue is not yet Fixed.

Please find below build and testing details.

Build Details:

VERSION: 8.5.0-Snapshot
BUILD: 55880
COMMIT: aae3ac0da7b6fcf75b78b81ad6da749833160b58
ARTIFACT PAGE: https://snapshots.elastic.co/8.5.0-17b8a62d/summary-8.5.0-SNAPSHOT.html

ScreenCast

https://user-images.githubusercontent.com/69579402/187607080-795108e6-84d5-4abf-903b-0dbae674a1d3.mp4

We will validate this issue once we receive a new build for snapshot that has merges for the fix.

Thank you!

[dasansol92]

Hey @vipulsrivastava-qasource , thanks for looking into it! This error is expected since a single special character is not allowed. The intention of the fix was avoid having the react minified error and show a Kibana request error instead. Let me know if you have any other question about it. cc: @kevinlog

[ghost]

Hi @dasansol92

Thank you for looking into this issue.

This error is expected since a single special character is not allowed.

This error comes only when we use comma symbol but apart from this we are able to search with all symbols. please refer the screencast below.

https://user-images.githubusercontent.com/69579402/187627554-1668ae6b-5a4e-43fd-b81c-39f6bf616585.mp4

Moreover, invalid value error comes when we use the comma symbol more than once.

https://user-images.githubusercontent.com/69579402/187627671-2d125fc7-51d5-4802-b5b0-07efd937a712.mp4

Please let us know if anything is missing from our end.

Thank you!.

[dasansol92]

@vipulsrivastava-qasource Thats correct, it only happens with the comma character. Thanks for double checking it!