elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.64k stars 8.23k forks source link

[Security Solution][Rules Management] Rules table breaks when filtering by some tags #194066

Open marshallmain opened 1 month ago

marshallmain commented 1 month ago

Steps to Reproduce

  1. Create a rule with a tag that contains \",
  2. Go to the rules table and attempt to filter by the tag containing \"

Summary

In https://github.com/elastic/kibana/blob/main/x-pack/plugins/security_solution/common/utils/kql.ts#L50 we have logic to create KQL query strings containing arbitrary values. As part of this logic we escape double quotes with backslashes since we wrap the individual values in double quotes. However, we don't escape backslashes, so the string \" becomes \\" which the KQL parser interprets as a literal backslash followed by double quote as a special character.

We should change the escaping logic to something like const escapeQuotes = (val: string) => val.replace(/[\\"]/g, '\\$&'); so the string \" in a tag becomes \\\" in the KQL query, and the parser interprets it as a literal backslash and literal double quote.

elasticmachine commented 1 month ago

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

marshallmain commented 1 month ago

Also consider resolving https://github.com/elastic/kibana/security/code-scanning/347 at the same time