elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.81k stars 8.2k forks source link

[Security Solution] Validation is not triggered correctly in rule actions form #142217

Open vitaliidm opened 2 years ago

vitaliidm commented 2 years ago

Steps to reproduce

Issue was found, once working on https://github.com/elastic/kibana/issues/140593. Rule actions form is marked as invalid, even though all fields are populated in slack action form

https://user-images.githubusercontent.com/92328789/193028904-c341e5d8-12d5-45cb-a803-aa3193852bc4.mov

  1. open rule actions form
  2. add slack action
  3. remove slack action
  4. add again slack action
  5. press Save rule
  6. validation error is displayed

Technical overview

Once slack rule actions form is rendered: First setActionIdByIndex in x-pack/plugins/security_solution/public/detections/components/rules/rule_actions_field/index.tsx fires update to actions field of form (but w/o params properties, only type of selector in action). Then, subsequently setActionParamsProperty updates params in field actions of form with values displayed if form controls through calling field.setValue. In our case, it is a message form field in slack action form.

These updates trigger form validation, defined in schema:

  actions: {
    validations: [
      {
        validator: validateRuleActionsField(actionTypeRegistry),
      },
    ],
  },

validateRuleActionsField receives in curried function argument field value:

    const [{ value, path }] = data as [{ value: RuleAction[]; path: string }];

which doesn't have updates set in setActionParamsProperty, hence form is marked as invalid. It happens consistently when you add some action, remove it, add again it.

Here is logged form value of actions in functions calls

setActionIdByIndex [
  {
    "id": "50a49d70-34d4-11ed-87dc-f3f665e2eedb",
    "actionTypeId": ".slack",
    "group": "default",
    "params": {}
  }
]
validateRuleActionsField [
  {
    "id": "50a49d70-34d4-11ed-87dc-f3f665e2eedb",
    "actionTypeId": ".slack",
    "group": "default",
    "params": {}
  }
]
validateRuleActionsField [
  {
    "id": "50a49d70-34d4-11ed-87dc-f3f665e2eedb",
    "actionTypeId": ".slack",
    "group": "default",
    "params": {}
  }
]
setActionParamsProperty [
  {
    "id": "50a49d70-34d4-11ed-87dc-f3f665e2eedb",
    "actionTypeId": ".slack",
    "group": "default",
    "params": {
      "message": "Rule {{context.rule.name}} generated {{state.signals_count}} alerts"
    }
  }
]

From the log above: validateRuleActionsField is not getting called after setActionParamsProperty is called, instead validateRuleActionsField called twice after setActionIdByIndex has been triggered.

Expected behaviour

Validation to be triggered once new params values were updated through setActionParamsProperty.

Workaround

elasticmachine commented 2 years ago

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine commented 2 years ago

Pinging @elastic/security-detections-response (Team:Detections and Resp)