Go to the rules table and attempt to filter by the tag containing \"
Summary
In https://github.com/elastic/kibana/blob/main/x-pack/plugins/security_solution/common/utils/kql.ts#L50 we have logic to create KQL query strings containing arbitrary values. As part of this logic we escape double quotes with backslashes since we wrap the individual values in double quotes. However, we don't escape backslashes, so the string \" becomes \\" which the KQL parser interprets as a literal backslash followed by double quote as a special character.
We should change the escaping logic to something like const escapeQuotes = (val: string) => val.replace(/[\\"]/g, '\\$&'); so the string \" in a tag becomes \\\" in the KQL query, and the parser interprets it as a literal backslash and literal double quote.
Steps to Reproduce
\"
,\"
Summary
In https://github.com/elastic/kibana/blob/main/x-pack/plugins/security_solution/common/utils/kql.ts#L50 we have logic to create KQL query strings containing arbitrary values. As part of this logic we escape double quotes with backslashes since we wrap the individual values in double quotes. However, we don't escape backslashes, so the string
\"
becomes\\"
which the KQL parser interprets as a literal backslash followed by double quote as a special character.We should change the escaping logic to something like
const escapeQuotes = (val: string) => val.replace(/[\\"]/g, '\\$&');
so the string\"
in a tag becomes\\\"
in the KQL query, and the parser interprets it as a literal backslash and literal double quote.