[HTTP] Safer client calls and new browser `buildPath` utility by jloleysens · Pull Request #257230 · elastic/kibana

jloleysens · 2026-03-11T15:48:09Z

Create a new best-effort ESLint rule that checks if http<method> calls are used dangerously: direct path injection
Adds a new buildPath utility that can be used with server-side routes /api/myapi/{id} to safely build and encode path parameters (bonus: server-side path consts can be reused by the client directly, no need to build these separately by hand)
Updates existing usages

No unsafe `http` path usage

Will flag usages of http like:

core.http.delete(`/api/myapi/${id}`, {...});

With a message to use buildPath or encodeURIComponent in order to safely encode parameters.

`buildPath`

Not strictly needed in this PR, this utility allows for using server side paths like /api/myapi/{id} in a parameterised fashion like:

import { buildPath } from '@kbn/core-http-browser';

buildPath('/api/dashboard/{id}' /* same as { path: ... } server side */, { id })
// => /api/dashboard/encoded-id

Happy to exclude this utility if it simplifies things.

(Made with cursor y'all)

elasticmachine · 2026-03-11T15:48:15Z

Pinging @elastic/kibana-core (Team:Core)

elasticmachine · 2026-03-11T15:48:36Z

🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

Click to trigger kibana-pull-request for this PR!
Click to trigger kibana-deploy-project-from-pr for this PR!
Click to trigger kibana-deploy-cloud-from-pr for this PR!
Click to trigger kibana-entity-store-performance-from-pr for this PR!
Click to trigger kibana-storybooks-from-pr for this PR!

jloleysens · 2026-03-11T15:58:52Z

/ci

jloleysens · 2026-03-12T12:51:41Z

/ci

jloleysens · 2026-03-12T13:42:20Z

/ci

jloleysens · 2026-03-12T14:46:48Z

/ci

jloleysens · 2026-03-13T14:52:00Z

/ci

jloleysens · 2026-03-19T10:22:23Z

/ci

Block encoded path traversal segments at the HTTP onRequest layer so Kibana rejects traversal attempts before routing or URL rewriting can redirect requests to unintended endpoints. Made-with: Cursor

This reverts commit eda3429.

Cover the new browser-side path builder and verify dashboard client routes encode path params instead of interpolating raw ids into request URLs. Made-with: Cursor

…r-build-path-utility

delanni · 2026-04-02T13:55:59Z

+    },
+    {
+      code: dedent`
+        const path = \`/api/dashboards/${'${id}'}\`;


It took me a bit to grasp what this is :) Was it your choice to 'escape' the variable symbols like this, or was this suggested by cursor?
If I had to chose, I'd pick the \ way:

Suggested change

const path = \`/api/dashboards/${'${id}'}\`;

const path = \`/api/dashboards/\${id}\`;

For some reason this format was not working, at least not as intended. I'll refactor for better readability. I agree the cruft introduced by ${'${... is pretty noisey

delanni

Outside the escaping nitpick, it looks good!

mashhurs

Logstash changes LGTM!

walterra

datavis code review only LGTM.

kibanamachine · 2026-04-23T09:11:02Z

Starting backport for target branches: 8.19, 9.2, 9.3, 9.4

https://github.com/elastic/kibana/actions/runs/24826911443

kibanamachine · 2026-04-23T09:20:38Z

💔 All backports failed

Status	Branch	Result
❌	8.19	Backport failed because of merge conflicts
❌	9.2	Backport failed because of merge conflicts
❌	9.3	Backport failed because of merge conflicts
❌	9.4	Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 257230

Questions ?

Please refer to the Backport tool documentation

kibanamachine · 2026-04-24T09:49:06Z

Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync.
cc: @jloleysens

kibanamachine · 2026-04-27T09:53:24Z

Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync.
cc: @jloleysens

…265249) ## Summary Backport #257230 to `8.19`. Resolved branch-specific conflicts while keeping the older `8.19` dashboard and lens implementations intact. ## Validation Could not run `node scripts/check_changes.ts` or Jest in the temporary backport repo because dependencies are not bootstrapped there. (Made with cursor y'all) --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Gerard Soldevila <gerard.soldevila@elastic.co> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: Jeramy Soucy <jeramy.soucy@elastic.co>

kibanamachine · 2026-04-28T10:48:58Z

Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync.
cc: @jloleysens

…65250) ## Summary Backport #257230 to `9.3`. Resolved branch-specific conflicts for the older branch layout while preserving the intended path-safety changes. ## Validation Could not run `node scripts/check_changes.ts` or Jest in the temporary backport repo because dependencies are not bootstrapped there. (Made with cursor y'all) --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Gerard Soldevila <gerard.soldevila@elastic.co> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

jloleysens requested review from a team as code owners March 11, 2026 15:48

jloleysens added Team:Core Platform Core services: plugins, logging, config, saved objects, http, ES client, i18n, etc t// release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting labels Mar 11, 2026

jloleysens marked this pull request as draft March 11, 2026 15:48

jloleysens changed the title ~~[HTTP] Browser buildPath utility~~ [HTTP] Safe delete calls and new browser buildPath utility Mar 12, 2026

jloleysens changed the title ~~[HTTP] Safe delete calls and new browser buildPath utility~~ [HTTP] Safer client calls and new browser buildPath utility Mar 12, 2026

jloleysens and others added 14 commits March 31, 2026 10:37

[Core] Add on-request path traversal guard POC

b97b1cd

Block encoded path traversal segments at the HTTP onRequest layer so Kibana rejects traversal attempts before routing or URL rewriting can redirect requests to unintended endpoints. Made-with: Cursor

Revert "[Core] Add on-request path traversal guard POC"

a7e6fdf

This reverts commit eda3429.

buildPath

585e6fd

[HTTP] Add buildPath test coverage

dd42dd9

Cover the new browser-side path builder and verify dashboard client routes encode path params instead of interpolating raw ids into request URLs. Made-with: Cursor

delete test

25d4db0

two required params

0e5d078

typo

59f5454

Changes from node scripts/lint_ts_projects --fix

010e8dd

Changes from node scripts/regenerate_moon_projects.js --update

ae92d4d

handle hapi path syntax

b3a1a5d

use buildPath in delete calls

834fcc5

added best-effort eslint rule to flag unsafe http.delet usages

c7aa871

fix projects

55b82c4

Changes from node scripts/regenerate_moon_projects.js --update

b551fc3

Merge remote-tracking branch 'upstream/main' into feature/http-browse…

05f5eea

…r-build-path-utility

delanni reviewed Apr 2, 2026

View reviewed changes

delanni approved these changes Apr 2, 2026

View reviewed changes

remove cruft

98ce5f5

jloleysens enabled auto-merge (squash) April 2, 2026 14:19

mashhurs approved these changes Apr 2, 2026

View reviewed changes

walterra approved these changes Apr 3, 2026

View reviewed changes

jloleysens merged commit 2d72284 into elastic:main Apr 3, 2026
19 checks passed

kibanamachine added the v9.4.0 label Apr 3, 2026

jloleysens deleted the feature/http-browser-build-path-utility branch April 23, 2026 09:07

jloleysens added v9.3.4 v8.19.15 backport:all-open Backport to all branches that could still receive a release and removed backport:skip This PR does not require backporting labels Apr 23, 2026

kibanamachine added the v9.5.0 label Apr 23, 2026

This was referenced Apr 23, 2026

[8.19] [HTTP] Safer client calls and new browser buildPath utility #265249

Merged

[9.3] [HTTP] Safer client calls and new browser buildPath utility #265250

Merged

kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label Apr 24, 2026

jeramysoucy mentioned this pull request Apr 27, 2026

[9.3] [HTTP] Safer client calls and new browser buildPath utility (#257230) #265811

Closed

kibanamachine mentioned this pull request Apr 28, 2026

[Search]Add custom telemetry events #265310

Merged

8 tasks

kibanamachine removed the backport missing Added to PRs automatically when the are determined to be missing a backport. label Apr 29, 2026

Ikuni17 added v9.3.5 and removed v9.3.4 labels May 1, 2026

	const path = \`/api/dashboards/${'${id}'}\`;
	const path = \`/api/dashboards/\${id}\`;

Conversation

jloleysens commented Mar 11, 2026 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

No unsafe http path usage

buildPath

Uh oh!

elasticmachine commented Mar 11, 2026

Uh oh!

elasticmachine commented Mar 11, 2026

Uh oh!

jloleysens commented Mar 11, 2026

Uh oh!

jloleysens commented Mar 12, 2026

Uh oh!

jloleysens commented Mar 12, 2026

Uh oh!

jloleysens commented Mar 12, 2026

Uh oh!

jloleysens commented Mar 13, 2026

Uh oh!

jloleysens commented Mar 19, 2026

Uh oh!

delanni Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

jloleysens Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

delanni left a comment

Choose a reason for hiding this comment

Uh oh!

mashhurs left a comment

Choose a reason for hiding this comment

Uh oh!

walterra left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kibanamachine commented Apr 23, 2026

Uh oh!

kibanamachine commented Apr 23, 2026

💔 All backports failed

Manual backport

Questions ?

Uh oh!

kibanamachine commented Apr 24, 2026

Uh oh!

kibanamachine commented Apr 27, 2026

Uh oh!

kibanamachine commented Apr 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

16 participants

jloleysens commented Mar 11, 2026 •

edited by kibanamachine

Loading

No unsafe `http` path usage

`buildPath`