Removes FindQueryHTTP['fields'] option in Saved Objects Management#152306
Conversation
TinaHeiligers
added
Team:Core
|
Pinging @elastic/kibana-core (Team:Core) |
|
@elasticmachine merge upstream |
TinaHeiligers
left a comment
TinaHeiligers
left a comment
There was a problem hiding this comment.
Self review
| search: queryText ? `${queryText}*` : undefined, | ||
| perPage, | ||
| page: page + 1, | ||
| fields: ['id'], |
There was a problem hiding this comment.
Rather than trying hard coding the option, I've removed it instead.
| saved_objects: savedObjects.map((so) => { | ||
| const obj = injectMetaAttributes(so, managementService); | ||
| const result = { ...obj, attributes: {} as Record<string, unknown> }; | ||
| for (const field of includedFields) { |
There was a problem hiding this comment.
Removes handling the 'fields' option in the query since we don't want to explicitly expose attributes in the response
|
|
||
| it('should return 200 with individual responses', async () => | ||
| await supertest | ||
| .get('/api/kibana/management/saved_objects/_find?type=visualization&fields=title') |
| }), | ||
| // fields: schema.oneOf([schema.string(), schema.arrayOf(schema.string())], { | ||
| // defaultValue: [], | ||
| // }), |
There was a problem hiding this comment.
i think you want to remove the fields schema rather than comment it out
jloleysens
left a comment
jloleysens
left a comment
There was a problem hiding this comment.
Great work @TinaHeiligers ! Pending @Bamieh 's comment, this LGTM. I tested locally and worked as expected.
|
@elasticmachine merge upstream |
💚 Build Succeeded
Metrics [docs]Async chunks
Unknown metric groupsESLint disabled line counts
Total ESLint disabled count
History
To update your PR or re-run it, just comment with: |
TinaHeiligers
deleted the
kbn-151427-findqueryhttp-type-remove-fields
branch
…lastic#152306) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
6 participants
fix #151427
The saved object's management (SOM) plugin allowed specifying saved object attributes by optionally accepting a
fieldsoption in_findcalls.This means that we could potentially leak the internal structure of saved objects in the browser.
Note: The SOM api's were not intended to be public, and this change is therefore not considered a breaking API change.
Checklist
Risk Matrix
fieldsquery returns a bad request; external plugins depending on the SOM feature no longer return expected results.For maintainers