[FSH] @kbn/fs package by elena-shostak · Pull Request #243037 · elastic/kibana

elena-shostak · 2025-11-14T12:31:23Z

Summary

Introduced the @kbn/fs package that wraps node fs API with safe defaults:

every write resolves paths under the repo data root folder
validates that there is no path traversal
validates allowed file extensions
validates allowed mime types
validates allowed file sizes
performs sanitization for svg

Introduced eslint rule @kbn/eslint/require_kbn_fs that flags the direct write fs calls in production code. Severity is set to warn for now and will be switched to error once migration is done in scope of #239385.

Exposed interface has a volume that serves as logical namespace. You select a volume (e.g., reports, exports/run-123) and pass a file name, getSafePath constructs a full path under data/volume/.... That allows us to introduce per-volume restrictions later (file size, mime types, etc) if needed and extend the interface without friction.

How to test

You can add a test route to check that out easily.

POST /internal/security/files

  export function defineFileRoutes({ router }: RouteDefinitionParams) {
    router.post(
      {
        path: '/internal/security/files',
        security: {
          authz: {
            enabled: false,
            reason: 'Test route for file operations',
          },
        },
        validate: {
          request: {
            body: schema.object({
              method: schema.string(),
              name: schema.string(),
              content: schema.string(),
              volume: schema.maybe(schema.string()),
            }),
          },
        },
      },
      createLicensedRouteHandler(async (context, request, response) => {
        const { method, name, content, volume = 'security-test' } = request.body;
  
        try {
          switch (method) {
            case 'writeFile':
              const resultWriteFile = await writeFile(name, content, {
                volume,
              });
  
              return response.ok({ body: resultWriteFile });
            case 'appendFile':
              const resultAppendFile = await appendFile(name, content, {
                volume,
              });
  
              return response.ok({ body: resultAppendFile });
            case 'writeFileSync':
              const resultWriteFileSync = writeFileSync(name, content, {
                volume,
              });
              return response.ok({ body: resultWriteFileSync });
            case 'appendFileSync':
              const resultAppendFileSync = appendFileSync(name, content, {
                volume,
              });
              return response.ok({ body: resultAppendFileSync });
  
            case 'createWriteStream':
              const writeStream = createWriteStream(name, volume);
              writeStream.write(content);
              writeStream.end();
              return response.ok({ body: 'ok' });
  
            case 'readFile':
              const fileContent = await readFile(name, volume);
              return response.ok({ body: fileContent });
  
            default:
              return response.customError(wrapIntoCustomErrorResponse(new Error('Invalid method')));
          }
        } catch (error) {
          return response.customError(wrapIntoCustomErrorResponse(error));
        }
      })
    );
  }

Checklist

Unit or functional tests were updated or added to match the most common scenarios
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
Review the backport guidelines and apply applicable backport:* labels.

Closes: #239382

## Summary Validation is covering the following scenarios: - [x] validate that directory is a safe path - [x] validate allowed file extensions - [x] validate allowed mime types - [x] validate allowed file sizes - [x] perform sanitization of file content for svg ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios __Closes: https://github.com/elastic/kibana/issues/239383__ --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…ature/fsh

elasticmachine · 2025-11-17T13:29:56Z

Pinging @elastic/kibana-security (Team:Security)

kibanamachine · 2025-11-17T13:30:11Z

Dependency Review Bot Analysis 🔍

Found 2 new third-party dependencies:

Package	Version	Vulnerabilities	Health Score
magic-bytes.js	^1.12.1	🔴 C: 0, 🟠 H: 0, 🟡 M: 0, 🟢 L: 0
dompurify	^3.3.0	🔴 C: 0, 🟠 H: 0, 🟡 M: 0, 🟢 L: 0

Self Checklist

To help with the review, please update the PR description to address the following points for each new third-party dependency listed above:

Purpose: What is this dependency used for? Briefly explain its role in your changes.
Justification: Why is adding this dependency the best approach?
Alternatives explored: Were other options considered (e.g., using existing internal libraries/utilities, implementing the functionality directly)? If so, why was this dependency chosen over them?
Existing dependencies: Does Kibana have a dependency providing similar functionality? If so, why is the new one preferred?

Thank you for providing this information!

…ature/fsh

elasticmachine · 2025-11-20T15:27:50Z

💚 Build Succeeded

Buildkite Build
Commit: 11a456e

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/fs`	-	2	+2

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`@kbn/fs`	-	3	+3

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`kbnUiSharedDeps-npmDll`	6.4MB	6.4MB	+3.0B

Unknown metric groups

API count

id	before	after	diff
`@kbn/fs`	-	38	+38

History

💔 Build #363134 failed 3b3df64
💔 Build #363047 failed b30354e
💚 Build #361796 succeeded a17972a
💔 Build #361726 failed 8b68ba9
💔 Build #361371 failed 77df488
💔 Build #361363 failed a1c05c0

kibanamachine · 2025-11-24T06:01:07Z

Starting backport for target branches: 8.18, 8.19, 9.0, 9.1, 9.2

https://github.com/elastic/kibana/actions/runs/19624860785

kibanamachine · 2025-11-24T06:09:39Z

💔 All backports failed

Status	Branch	Result
❌	8.18	Backport failed because of merge conflicts
❌	8.19	Backport failed because of merge conflicts
❌	9.0	Backport failed because of merge conflicts
❌	9.1	Backport failed because of merge conflicts You might need to backport the following PRs to 9.1: - [CI] Auto regenerate moon projects (#237609) - Update dependency @xyflow/react to ^12.9.2 (main) (#243136) - Use a package-based TSConfig base file (#217159)
❌	9.2	Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 243037

Questions ?

Please refer to the Backport tool documentation

## Summary Introduced the `@kbn/fs` package that wraps node `fs` API with safe defaults: - every write resolves paths under the repo `data` root folder - validates that there is no path traversal - validates allowed file extensions - validates allowed mime types - validates allowed file sizes - performs sanitization for svg Introduced eslint rule `@kbn/eslint/require_kbn_fs` that flags the direct write `fs` calls in production code. Severity is set to `warn` for now and will be switched to `error` once migration is done in scope of elastic#239385. Exposed interface has a `volume` that serves as logical namespace. You select a volume (e.g., `reports`, `exports/run-123`) and pass a file name, `getSafePath` constructs a full path under `data/volume/...`. That allows us to introduce per-volume restrictions later (file size, mime types, etc) if needed and extend the interface without friction. ## How to test You can add a test route to check that out easily. <details> <summary>POST /internal/security/files</summary> ```ts export function defineFileRoutes({ router }: RouteDefinitionParams) { router.post( { path: '/internal/security/files', security: { authz: { enabled: false, reason: 'Test route for file operations', }, }, validate: { request: { body: schema.object({ method: schema.string(), name: schema.string(), content: schema.string(), volume: schema.maybe(schema.string()), }), }, }, }, createLicensedRouteHandler(async (context, request, response) => { const { method, name, content, volume = 'security-test' } = request.body; try { switch (method) { case 'writeFile': const resultWriteFile = await writeFile(name, content, { volume, }); return response.ok({ body: resultWriteFile }); case 'appendFile': const resultAppendFile = await appendFile(name, content, { volume, }); return response.ok({ body: resultAppendFile }); case 'writeFileSync': const resultWriteFileSync = writeFileSync(name, content, { volume, }); return response.ok({ body: resultWriteFileSync }); case 'appendFileSync': const resultAppendFileSync = appendFileSync(name, content, { volume, }); return response.ok({ body: resultAppendFileSync }); case 'createWriteStream': const writeStream = createWriteStream(name, volume); writeStream.write(content); writeStream.end(); return response.ok({ body: 'ok' }); case 'readFile': const fileContent = await readFile(name, volume); return response.ok({ body: fileContent }); default: return response.customError(wrapIntoCustomErrorResponse(new Error('Invalid method'))); } } catch (error) { return response.customError(wrapIntoCustomErrorResponse(error)); } }) ); } ``` </details> ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. __Closes: https://github.com/elastic/kibana/issues/239382__ --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 20efb62) # Conflicts: # .buildkite/scripts/steps/security/third_party_packages.txt

## Summary Introduced the `@kbn/fs` package that wraps node `fs` API with safe defaults: - every write resolves paths under the repo `data` root folder - validates that there is no path traversal - validates allowed file extensions - validates allowed mime types - validates allowed file sizes - performs sanitization for svg Introduced eslint rule `@kbn/eslint/require_kbn_fs` that flags the direct write `fs` calls in production code. Severity is set to `warn` for now and will be switched to `error` once migration is done in scope of elastic#239385. Exposed interface has a `volume` that serves as logical namespace. You select a volume (e.g., `reports`, `exports/run-123`) and pass a file name, `getSafePath` constructs a full path under `data/volume/...`. That allows us to introduce per-volume restrictions later (file size, mime types, etc) if needed and extend the interface without friction. ## How to test You can add a test route to check that out easily. <details> <summary>POST /internal/security/files</summary> ```ts export function defineFileRoutes({ router }: RouteDefinitionParams) { router.post( { path: '/internal/security/files', security: { authz: { enabled: false, reason: 'Test route for file operations', }, }, validate: { request: { body: schema.object({ method: schema.string(), name: schema.string(), content: schema.string(), volume: schema.maybe(schema.string()), }), }, }, }, createLicensedRouteHandler(async (context, request, response) => { const { method, name, content, volume = 'security-test' } = request.body; try { switch (method) { case 'writeFile': const resultWriteFile = await writeFile(name, content, { volume, }); return response.ok({ body: resultWriteFile }); case 'appendFile': const resultAppendFile = await appendFile(name, content, { volume, }); return response.ok({ body: resultAppendFile }); case 'writeFileSync': const resultWriteFileSync = writeFileSync(name, content, { volume, }); return response.ok({ body: resultWriteFileSync }); case 'appendFileSync': const resultAppendFileSync = appendFileSync(name, content, { volume, }); return response.ok({ body: resultAppendFileSync }); case 'createWriteStream': const writeStream = createWriteStream(name, volume); writeStream.write(content); writeStream.end(); return response.ok({ body: 'ok' }); case 'readFile': const fileContent = await readFile(name, volume); return response.ok({ body: fileContent }); default: return response.customError(wrapIntoCustomErrorResponse(new Error('Invalid method'))); } } catch (error) { return response.customError(wrapIntoCustomErrorResponse(error)); } }) ); } ``` </details> ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. __Closes: https://github.com/elastic/kibana/issues/239382__ --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 20efb62) # Conflicts: # .buildkite/scripts/steps/security/third_party_packages.txt # .eslintrc.js # .github/CODEOWNERS # package.json # src/dev/license_checker/config.ts # tsconfig.base.json # yarn.lock

## Summary Introduced the `@kbn/fs` package that wraps node `fs` API with safe defaults: - every write resolves paths under the repo `data` root folder - validates that there is no path traversal - validates allowed file extensions - validates allowed mime types - validates allowed file sizes - performs sanitization for svg Introduced eslint rule `@kbn/eslint/require_kbn_fs` that flags the direct write `fs` calls in production code. Severity is set to `warn` for now and will be switched to `error` once migration is done in scope of elastic#239385. Exposed interface has a `volume` that serves as logical namespace. You select a volume (e.g., `reports`, `exports/run-123`) and pass a file name, `getSafePath` constructs a full path under `data/volume/...`. That allows us to introduce per-volume restrictions later (file size, mime types, etc) if needed and extend the interface without friction. ## How to test You can add a test route to check that out easily. <details> <summary>POST /internal/security/files</summary> ```ts export function defineFileRoutes({ router }: RouteDefinitionParams) { router.post( { path: '/internal/security/files', security: { authz: { enabled: false, reason: 'Test route for file operations', }, }, validate: { request: { body: schema.object({ method: schema.string(), name: schema.string(), content: schema.string(), volume: schema.maybe(schema.string()), }), }, }, }, createLicensedRouteHandler(async (context, request, response) => { const { method, name, content, volume = 'security-test' } = request.body; try { switch (method) { case 'writeFile': const resultWriteFile = await writeFile(name, content, { volume, }); return response.ok({ body: resultWriteFile }); case 'appendFile': const resultAppendFile = await appendFile(name, content, { volume, }); return response.ok({ body: resultAppendFile }); case 'writeFileSync': const resultWriteFileSync = writeFileSync(name, content, { volume, }); return response.ok({ body: resultWriteFileSync }); case 'appendFileSync': const resultAppendFileSync = appendFileSync(name, content, { volume, }); return response.ok({ body: resultAppendFileSync }); case 'createWriteStream': const writeStream = createWriteStream(name, volume); writeStream.write(content); writeStream.end(); return response.ok({ body: 'ok' }); case 'readFile': const fileContent = await readFile(name, volume); return response.ok({ body: fileContent }); default: return response.customError(wrapIntoCustomErrorResponse(new Error('Invalid method'))); } } catch (error) { return response.customError(wrapIntoCustomErrorResponse(error)); } }) ); } ``` </details> ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. __Closes: https://github.com/elastic/kibana/issues/239382__ --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 20efb62) # Conflicts: # .buildkite/scripts/steps/security/third_party_packages.txt # .eslintrc.js # .github/CODEOWNERS # package.json

## Summary Introduced the `@kbn/fs` package that wraps node `fs` API with safe defaults: - every write resolves paths under the repo `data` root folder - validates that there is no path traversal - validates allowed file extensions - validates allowed mime types - validates allowed file sizes - performs sanitization for svg Introduced eslint rule `@kbn/eslint/require_kbn_fs` that flags the direct write `fs` calls in production code. Severity is set to `warn` for now and will be switched to `error` once migration is done in scope of elastic#239385. Exposed interface has a `volume` that serves as logical namespace. You select a volume (e.g., `reports`, `exports/run-123`) and pass a file name, `getSafePath` constructs a full path under `data/volume/...`. That allows us to introduce per-volume restrictions later (file size, mime types, etc) if needed and extend the interface without friction. ## How to test You can add a test route to check that out easily. <details> <summary>POST /internal/security/files</summary> ```ts export function defineFileRoutes({ router }: RouteDefinitionParams) { router.post( { path: '/internal/security/files', security: { authz: { enabled: false, reason: 'Test route for file operations', }, }, validate: { request: { body: schema.object({ method: schema.string(), name: schema.string(), content: schema.string(), volume: schema.maybe(schema.string()), }), }, }, }, createLicensedRouteHandler(async (context, request, response) => { const { method, name, content, volume = 'security-test' } = request.body; try { switch (method) { case 'writeFile': const resultWriteFile = await writeFile(name, content, { volume, }); return response.ok({ body: resultWriteFile }); case 'appendFile': const resultAppendFile = await appendFile(name, content, { volume, }); return response.ok({ body: resultAppendFile }); case 'writeFileSync': const resultWriteFileSync = writeFileSync(name, content, { volume, }); return response.ok({ body: resultWriteFileSync }); case 'appendFileSync': const resultAppendFileSync = appendFileSync(name, content, { volume, }); return response.ok({ body: resultAppendFileSync }); case 'createWriteStream': const writeStream = createWriteStream(name, volume); writeStream.write(content); writeStream.end(); return response.ok({ body: 'ok' }); case 'readFile': const fileContent = await readFile(name, volume); return response.ok({ body: fileContent }); default: return response.customError(wrapIntoCustomErrorResponse(new Error('Invalid method'))); } } catch (error) { return response.customError(wrapIntoCustomErrorResponse(error)); } }) ); } ``` </details> ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. __Closes: https://github.com/elastic/kibana/issues/239382__ --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 20efb62) # Conflicts: # .buildkite/scripts/steps/security/third_party_packages.txt # .eslintrc.js # .github/CODEOWNERS # package.json # packages/kbn-eslint-plugin-eslint/index.js # src/dev/license_checker/config.ts # tsconfig.base.json # yarn.lock

elena-shostak · 2025-11-24T13:34:12Z

Status	Branch	Result
✅	9.2
✅	9.1
✅	8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Manual backport

To create the backport manually run:

node scripts/backport --pr 243037

Questions ?

Please refer to the Backport tool documentation

## Summary Introduced the `@kbn/fs` package that wraps node `fs` API with safe defaults: - every write resolves paths under the repo `data` root folder - validates that there is no path traversal - validates allowed file extensions - validates allowed mime types - validates allowed file sizes - performs sanitization for svg Introduced eslint rule `@kbn/eslint/require_kbn_fs` that flags the direct write `fs` calls in production code. Severity is set to `warn` for now and will be switched to `error` once migration is done in scope of elastic#239385. Exposed interface has a `volume` that serves as logical namespace. You select a volume (e.g., `reports`, `exports/run-123`) and pass a file name, `getSafePath` constructs a full path under `data/volume/...`. That allows us to introduce per-volume restrictions later (file size, mime types, etc) if needed and extend the interface without friction. ## How to test You can add a test route to check that out easily. <details> <summary>POST /internal/security/files</summary> ```ts export function defineFileRoutes({ router }: RouteDefinitionParams) { router.post( { path: '/internal/security/files', security: { authz: { enabled: false, reason: 'Test route for file operations', }, }, validate: { request: { body: schema.object({ method: schema.string(), name: schema.string(), content: schema.string(), volume: schema.maybe(schema.string()), }), }, }, }, createLicensedRouteHandler(async (context, request, response) => { const { method, name, content, volume = 'security-test' } = request.body; try { switch (method) { case 'writeFile': const resultWriteFile = await writeFile(name, content, { volume, }); return response.ok({ body: resultWriteFile }); case 'appendFile': const resultAppendFile = await appendFile(name, content, { volume, }); return response.ok({ body: resultAppendFile }); case 'writeFileSync': const resultWriteFileSync = writeFileSync(name, content, { volume, }); return response.ok({ body: resultWriteFileSync }); case 'appendFileSync': const resultAppendFileSync = appendFileSync(name, content, { volume, }); return response.ok({ body: resultAppendFileSync }); case 'createWriteStream': const writeStream = createWriteStream(name, volume); writeStream.write(content); writeStream.end(); return response.ok({ body: 'ok' }); case 'readFile': const fileContent = await readFile(name, volume); return response.ok({ body: fileContent }); default: return response.customError(wrapIntoCustomErrorResponse(new Error('Invalid method'))); } } catch (error) { return response.customError(wrapIntoCustomErrorResponse(error)); } }) ); } ``` </details> ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. __Closes: https://github.com/elastic/kibana/issues/239382__ --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 20efb62) # Conflicts: # .buildkite/scripts/steps/security/third_party_packages.txt # package.json

# Backport This will backport the following commits from `main` to `9.2`: - [[FSH] @kbn/fs package (#243037)](#243037)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)

# Backport This will backport the following commits from `main` to `8.19`: - [[FSH] @kbn/fs package (#243037)](#243037)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)

kibanamachine · 2025-11-25T06:48:53Z

Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync.
cc: @elena-shostak

# Backport This will backport the following commits from `main` to `9.1`: - [[FSH] @kbn/fs package (#243037)](#243037)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)

## Summary Introduced the `@kbn/fs` package that wraps node `fs` API with safe defaults: - every write resolves paths under the repo `data` root folder - validates that there is no path traversal - validates allowed file extensions - validates allowed mime types - validates allowed file sizes - performs sanitization for svg Introduced eslint rule `@kbn/eslint/require_kbn_fs` that flags the direct write `fs` calls in production code. Severity is set to `warn` for now and will be switched to `error` once migration is done in scope of elastic#239385. Exposed interface has a `volume` that serves as logical namespace. You select a volume (e.g., `reports`, `exports/run-123`) and pass a file name, `getSafePath` constructs a full path under `data/volume/...`. That allows us to introduce per-volume restrictions later (file size, mime types, etc) if needed and extend the interface without friction. ## How to test You can add a test route to check that out easily. <details> <summary>POST /internal/security/files</summary> ```ts export function defineFileRoutes({ router }: RouteDefinitionParams) { router.post( { path: '/internal/security/files', security: { authz: { enabled: false, reason: 'Test route for file operations', }, }, validate: { request: { body: schema.object({ method: schema.string(), name: schema.string(), content: schema.string(), volume: schema.maybe(schema.string()), }), }, }, }, createLicensedRouteHandler(async (context, request, response) => { const { method, name, content, volume = 'security-test' } = request.body; try { switch (method) { case 'writeFile': const resultWriteFile = await writeFile(name, content, { volume, }); return response.ok({ body: resultWriteFile }); case 'appendFile': const resultAppendFile = await appendFile(name, content, { volume, }); return response.ok({ body: resultAppendFile }); case 'writeFileSync': const resultWriteFileSync = writeFileSync(name, content, { volume, }); return response.ok({ body: resultWriteFileSync }); case 'appendFileSync': const resultAppendFileSync = appendFileSync(name, content, { volume, }); return response.ok({ body: resultAppendFileSync }); case 'createWriteStream': const writeStream = createWriteStream(name, volume); writeStream.write(content); writeStream.end(); return response.ok({ body: 'ok' }); case 'readFile': const fileContent = await readFile(name, volume); return response.ok({ body: fileContent }); default: return response.customError(wrapIntoCustomErrorResponse(new Error('Invalid method'))); } } catch (error) { return response.customError(wrapIntoCustomErrorResponse(error)); } }) ); } ``` </details> ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. __Closes: https://github.com/elastic/kibana/issues/239382__ --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

elena-shostak changed the title ~~@kbn/fs package~~ [FSH] @kbn/fs package Nov 14, 2025

elena-shostak and others added 8 commits November 14, 2025 16:32

[FSH] Added eslint rule for enforcing kbn/fs package

50ef3a3

[FSH] Added package with basic functionality

91d86a8

[FSH] Cleaned up path traversal cheks

d7b6e7e

Fixes

79701c4

Added eslint check

63993d8

Test changes

a0156b1

Changes from node scripts/generate codeowners

2ffae5f

elena-shostak force-pushed the feature/fsh branch from 77df488 to 2ffae5f Compare November 14, 2025 15:33

elena-shostak and others added 5 commits November 17, 2025 10:12

Merge branch 'main' into feature/fsh

8b68ba9

Changes from node scripts/generate codeowners

d9c1558

Tests

2612820

Merge branch 'feature/fsh' of github.com:elena-shostak/kibana into fe…

762a1c4

…ature/fsh

Merge branch 'main' into feature/fsh

a17972a

elena-shostak requested a review from kc13greiner November 17, 2025 13:29

elena-shostak marked this pull request as ready for review November 17, 2025 13:29

elena-shostak requested review from a team as code owners November 17, 2025 13:29

elena-shostak and others added 3 commits November 20, 2025 12:32

Merge branch 'feature/fsh' of github.com:elena-shostak/kibana into fe…

40d824c

…ature/fsh

Merge branch 'main' into feature/fsh

3b3df64

Merge branch 'main' into feature/fsh

11a456e

Ikuni17 approved these changes Nov 22, 2025

View reviewed changes

Merge branch 'main' into feature/fsh

9ab7fbe

elena-shostak merged commit 20efb62 into elastic:main Nov 24, 2025
13 checks passed

kibanamachine added the v9.3.0 label Nov 24, 2025

elena-shostak mentioned this pull request Nov 24, 2025

[9.2] [FSH] @kbn/fs package (#243037) #243976

Merged

This was referenced Nov 24, 2025

[9.0] [FSH] @kbn/fs package (#243037) #243978

Closed

[8.19] [FSH] @kbn/fs package (#243037) #243986

Merged

elena-shostak mentioned this pull request Nov 24, 2025

[8.18] [FSH] @kbn/fs package (#243037) #243988

Closed

elena-shostak mentioned this pull request Nov 24, 2025

[9.1] [FSH] @kbn/fs package (#243037) #243990

Merged

kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label Nov 25, 2025

kibanamachine removed the backport missing Added to PRs automatically when the are determined to be missing a backport. label Nov 25, 2025

elena-shostak removed v8.18.9 v9.0.9 labels Nov 25, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[FSH] @kbn/fs package #243037

[FSH] @kbn/fs package #243037
elena-shostak merged 20 commits intoelastic:mainfrom
elena-shostak:feature/fsh

elena-shostak commented Nov 14, 2025 •

edited by kibanamachine

Loading

Uh oh!

elasticmachine commented Nov 17, 2025

Uh oh!

kibanamachine commented Nov 17, 2025 •

edited

Loading

Uh oh!

elasticmachine commented Nov 20, 2025

API count

Uh oh!

Uh oh!

kibanamachine commented Nov 24, 2025

Uh oh!

kibanamachine commented Nov 24, 2025

Uh oh!

elena-shostak commented Nov 24, 2025 •

edited

Loading

Uh oh!

kibanamachine commented Nov 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

elena-shostak commented Nov 14, 2025 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

How to test

Checklist

Uh oh!

elasticmachine commented Nov 17, 2025

Uh oh!

kibanamachine commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Self Checklist

Uh oh!

elasticmachine commented Nov 20, 2025

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Public APIs missing exports

Page load bundle

API count

History

Uh oh!

Uh oh!

kibanamachine commented Nov 24, 2025

Uh oh!

kibanamachine commented Nov 24, 2025

💔 All backports failed

Manual backport

Questions ?

Uh oh!

elena-shostak commented Nov 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Manual backport

Questions ?

Uh oh!

kibanamachine commented Nov 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

elena-shostak commented Nov 14, 2025 •

edited by kibanamachine

Loading

kibanamachine commented Nov 17, 2025 •

edited

Loading

elena-shostak commented Nov 24, 2025 •

edited

Loading