@@ -22,8 +22,10 @@ Refer to [divio documentation](https://documentation.divio.com/) for guidance on
2222
2323<DocLink id = " kibDevDocsWelcome" text = " Getting started"
2424<DocLink id = " kibPlatformIntro" text = " Key concepts" _ explanation_ oriented,
25- <DocLink id = " kibDevTutorialBuildAPlugin" text = " Tutorials" _ tutorials_ and _ How to_ , and
26- the <DocLink id = " kibDevDocsApiWelcome" text = " API documentation" _ reference_ material.
25+ <DocLink id = " kibDevTutorialDebugging" text = " Tutorials" _ tutorials_ and _ How to_ , and the <DocLink
26+ id = " kibDevDocsApiWelcome"
27+ text = " API documentation"
28+ /> section covers _ reference_ material.
2729
2830#### Location
2931
@@ -256,17 +258,17 @@ links](https://elastic.github.io/eui/#/navigation/link#link-validation), and a r
256258
257259** Best practices**
258260
259- * Check for dangerous functions or assignments that can result in unescaped user input in the browser DOM. Avoid using:
260- * ** React:** [ ` dangerouslySetInnerHtml ` ] ( https://reactjs.org/docs/dom-elements.html#dangerouslysetinnerhtml ) .
261- * ** Browser DOM:** ` Element.innerHTML ` and ` Element.outerHTML ` .
262- * If using the aforementioned unsafe functions or assignments is absolutely necessary, follow [ these XSS prevention
263- rules] ( https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#xss-prevention-rules ) to ensure that
264- user input is not inserted into unsafe locations and that it is escaped properly.
265- * Use EUI components to build your UI, particularly when rendering ` href ` links. Otherwise, sanitize user input before rendering links to
266- ensure that they do not use the ` javascript: ` protocol.
267- * Don't use the ` eval ` , ` Function ` , and ` _.template ` functions -- these are restricted by ESLint rules.
268- * Be careful when using ` setTimeout ` and ` setInterval ` in client-side code. If an attacker can manipulate the arguments and pass a string to
269- one of these, it is evaluated dynamically, which is equivalent to the dangerous ` eval ` function.
261+ - Check for dangerous functions or assignments that can result in unescaped user input in the browser DOM. Avoid using:
262+ - ** React:** [ ` dangerouslySetInnerHtml ` ] ( https://reactjs.org/docs/dom-elements.html#dangerouslysetinnerhtml ) .
263+ - ** Browser DOM:** ` Element.innerHTML ` and ` Element.outerHTML ` .
264+ - If using the aforementioned unsafe functions or assignments is absolutely necessary, follow [ these XSS prevention
265+ rules] ( https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#xss-prevention-rules ) to ensure that
266+ user input is not inserted into unsafe locations and that it is escaped properly.
267+ - Use EUI components to build your UI, particularly when rendering ` href ` links. Otherwise, sanitize user input before rendering links to
268+ ensure that they do not use the ` javascript: ` protocol.
269+ - Don't use the ` eval ` , ` Function ` , and ` _.template ` functions -- these are restricted by ESLint rules.
270+ - Be careful when using ` setTimeout ` and ` setInterval ` in client-side code. If an attacker can manipulate the arguments and pass a string to
271+ one of these, it is evaluated dynamically, which is equivalent to the dangerous ` eval ` function.
270272
271273### Cross-Site Request Forgery (CSRF/XSRF)
272274
@@ -280,10 +282,10 @@ Headers](https://www.elastic.co/guide/en/kibana/master/api.html#api-request-head
280282
281283** Best practices**
282284
283- * Ensure all HTTP routes are registered with the [ Kibana HTTP service] ( https://www.elastic.co/guide/en/kibana/master/http-service.html ) to
284- take advantage of the custom request header security control.
285- * Note that HTTP GET requests do ** not** require the custom request header; any routes that change data should [ adhere to the HTTP
286- specification and use a different method (PUT, POST, etc.)] ( https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods )
285+ - Ensure all HTTP routes are registered with the [ Kibana HTTP service] ( https://www.elastic.co/guide/en/kibana/master/http-service.html ) to
286+ take advantage of the custom request header security control.
287+ - Note that HTTP GET requests do ** not** require the custom request header; any routes that change data should [ adhere to the HTTP
288+ specification and use a different method (PUT, POST, etc.)] ( https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods )
287289
288290### Remote Code Execution (RCE)
289291
@@ -295,11 +297,11 @@ ESLint rules to restrict vulnerable functions, and by hooking into or hardening
295297
296298** Best practices**
297299
298- * Don't use the ` eval ` , ` Function ` , and ` _.template ` functions -- these are restricted by ESLint rules.
299- * Don't use dynamic ` require ` .
300- * Check for usages of templating libraries. Ensure that user-provided input doesn't influence the template and is used only as data for
301- rendering the template.
302- * Take extra caution when spawning child processes with any user input or parameters that are user-controlled.
300+ - Don't use the ` eval ` , ` Function ` , and ` _.template ` functions -- these are restricted by ESLint rules.
301+ - Don't use dynamic ` require ` .
302+ - Check for usages of templating libraries. Ensure that user-provided input doesn't influence the template and is used only as data for
303+ rendering the template.
304+ - Take extra caution when spawning child processes with any user input or parameters that are user-controlled.
303305
304306### Prototype Pollution
305307
@@ -309,26 +311,26 @@ hardening sensitive functions (such as those exposed by `child_process`), and by
309311
310312** Best practices**
311313
312- * Check for instances of ` anObject[a][b] = c ` where ` a ` , ` b ` , and ` c ` are controlled by user input. This includes code paths where the
313- following logical code steps could be performed in separate files by completely different operations, or by recursively using dynamic
314- operations.
315- * Validate all user input, including API URL parameters, query parameters, and payloads. Preferably, use a schema that only allows specific
316- keys and values. At a minimum, implement a deny-list that prevents ` __proto__ ` and ` prototype.constructor ` from being used within object
317- keys.
318- * When calling APIs that spawn new processes or perform code generation from strings, protect against Prototype Pollution by checking if
319- ` Object.hasOwnProperty ` has arguments to the APIs that originate from an Object. An example is the defunct Code app's
320- [ ` spawnProcess ` ] ( https://github.com/elastic/kibana/blob/b49192626a8528af5d888545fb14cd1ce66a72e7/x-pack/legacy/plugins/code/server/lsp/workspace_command.ts#L40-L44 )
321- function.
322- * Common Node.js offenders: ` child_process.spawn ` , ` child_process.exec ` , ` eval ` , ` Function('some string') ` , ` vm.runInContext(x) ` ,
323- ` vm.runInNewContext(x) ` , ` vm.runInThisContext() `
324- * Common client-side offenders: ` eval ` , ` Function('some string') ` , ` setTimeout('some string', num) ` , ` setInterval('some string', num) `
314+ - Check for instances of ` anObject[a][b] = c ` where ` a ` , ` b ` , and ` c ` are controlled by user input. This includes code paths where the
315+ following logical code steps could be performed in separate files by completely different operations, or by recursively using dynamic
316+ operations.
317+ - Validate all user input, including API URL parameters, query parameters, and payloads. Preferably, use a schema that only allows specific
318+ keys and values. At a minimum, implement a deny-list that prevents ` __proto__ ` and ` prototype.constructor ` from being used within object
319+ keys.
320+ - When calling APIs that spawn new processes or perform code generation from strings, protect against Prototype Pollution by checking if
321+ ` Object.hasOwnProperty ` has arguments to the APIs that originate from an Object. An example is the defunct Code app's
322+ [ ` spawnProcess ` ] ( https://github.com/elastic/kibana/blob/b49192626a8528af5d888545fb14cd1ce66a72e7/x-pack/legacy/plugins/code/server/lsp/workspace_command.ts#L40-L44 )
323+ function.
324+ - Common Node.js offenders: ` child_process.spawn ` , ` child_process.exec ` , ` eval ` , ` Function('some string') ` , ` vm.runInContext(x) ` ,
325+ ` vm.runInNewContext(x) ` , ` vm.runInThisContext() `
326+ - Common client-side offenders: ` eval ` , ` Function('some string') ` , ` setTimeout('some string', num) ` , ` setInterval('some string', num) `
325327
326328See also:
327329
328- * [ Prototype pollution: The dangerous and underrated vulnerability impacting JavaScript applications |
329- portswigger.net] ( https://portswigger.net/daily-swig/prototype-pollution-the-dangerous-and-underrated-vulnerability-impacting-javascript-applications )
330- * [ Prototype pollution attack in NodeJS application | Olivier
331- Arteau] ( https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf )
330+ - [ Prototype pollution: The dangerous and underrated vulnerability impacting JavaScript applications |
331+ portswigger.net] ( https://portswigger.net/daily-swig/prototype-pollution-the-dangerous-and-underrated-vulnerability-impacting-javascript-applications )
332+ - [ Prototype pollution attack in NodeJS application | Olivier
333+ Arteau] ( https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf )
332334
333335### Server-Side Request Forgery (SSRF)
334336
@@ -339,12 +341,12 @@ a vector for information disclosure or injection attacks.
339341
340342** Best practices**
341343
342- * Ensure that all outbound requests from the Kibana server use hard-coded URLs.
343- * If user input is used to construct a URL for an outbound request, ensure that an allow-list is used to validate the endpoints and that
344- user input is escaped properly. Ideally, the allow-list should be set in ` kibana.yml ` , so only server administrators can change it.
345- * This is particularly relevant when using ` transport.request ` with the Elasticsearch client, as no automatic escaping is performed.
346- * Note that URLs are very hard to validate properly; exact match validation for user input is most preferable, while URL parsing or RegEx
347- validation should only be used if absolutely necessary.
344+ - Ensure that all outbound requests from the Kibana server use hard-coded URLs.
345+ - If user input is used to construct a URL for an outbound request, ensure that an allow-list is used to validate the endpoints and that
346+ user input is escaped properly. Ideally, the allow-list should be set in ` kibana.yml ` , so only server administrators can change it.
347+ - This is particularly relevant when using ` transport.request ` with the Elasticsearch client, as no automatic escaping is performed.
348+ - Note that URLs are very hard to validate properly; exact match validation for user input is most preferable, while URL parsing or RegEx
349+ validation should only be used if absolutely necessary.
348350
349351### Reverse tabnabbing
350352
@@ -356,10 +358,10 @@ buttons, and other vulnerable DOM elements.
356358
357359** Best practices**
358360
359- * Use EUI components to build your UI whenever possible. Otherwise, ensure that any DOM elements that have an ` href ` attribute also have the
360- ` rel="noreferrer noopener" ` attribute specified. For more information, refer to the [ OWASP HTML5 Security Cheat
361- Sheet] ( https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/HTML5_Security_Cheat_Sheet.md#tabnabbing ) .
362- * If using a non-EUI markdown renderer, use a custom link renderer for rendered links.
361+ - Use EUI components to build your UI whenever possible. Otherwise, ensure that any DOM elements that have an ` href ` attribute also have the
362+ ` rel="noreferrer noopener" ` attribute specified. For more information, refer to the [ OWASP HTML5 Security Cheat
363+ Sheet] ( https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/HTML5_Security_Cheat_Sheet.md#tabnabbing ) .
364+ - If using a non-EUI markdown renderer, use a custom link renderer for rendered links.
363365
364366### Information disclosure
365367
@@ -370,7 +372,7 @@ control, but at a high level, Kibana relies on the hapi framework to automatical
370372
371373** Best practices**
372374
373- * Look for instances where sensitive information might accidentally be revealed, particularly in error messages, in the UI, and URL
374- parameters that are exposed to users.
375- * Make sure that sensitive request data is not forwarded to external resources. For example, copying client request headers and using them
376- to make an another request could accidentally expose the user's credentials.
375+ - Look for instances where sensitive information might accidentally be revealed, particularly in error messages, in the UI, and URL
376+ parameters that are exposed to users.
377+ - Make sure that sensitive request data is not forwarded to external resources. For example, copying client request headers and using them
378+ to make an another request could accidentally expose the user's credentials.
0 commit comments