[CVE] Handle invalid query, index and date in vega charts filter handlers by bandinib-amzn · Pull Request #1932 · opensearch-project/OpenSearch-Dashboards

bandinib-amzn · 2022-07-22T00:01:22Z

Description

Potential way to prevent XSS vulnerability discovered in the Vega charts OSD integration.

CVE link:
https://nvd.nist.gov/vuln/detail/CVE-2022-23713

Signed-off-by: Bandini Bhopi bandinib@amazon.com

Testing:

Sanity testing by creating Vega visualization from Vega Example Gallery

Check List

…lers Potential way to prevent XSS vulnerability discovered in the Vega charts OSD integration. CVE link: https://nvd.nist.gov/vuln/detail/CVE-2022-23713 Signed-off-by: Bandini Bhopi <bandinib@amazon.com>

kavilla

Looks pretty good! Just some license headers stuff and we can probably backport this to the 1.x branch.

Signed-off-by: Bandini Bhopi <bandinib@amazon.com>

codecov-commenter · 2022-07-26T21:35:36Z

Codecov Report

Merging #1932 (995df04) into main (57a751e) will increase coverage by 0.01%.
The diff coverage is 84.44%.

@@            Coverage Diff             @@
##             main    #1932      +/-   ##
==========================================
+ Coverage   67.48%   67.50%   +0.01%     
==========================================
  Files        3076     3077       +1     
  Lines       59144    59184      +40     
  Branches     8989     9003      +14     
==========================================
+ Hits        39915    39953      +38     
- Misses      17044    17045       +1     
- Partials     2185     2186       +1

Impacted Files	Coverage Δ
...s/vis_type_vega/public/vega_view/vega_base_view.js	`55.55% <0.00%> (ø)`
packages/osd-std/src/validate_object.ts	`91.30% <91.30%> (ø)`
...c/plugins/vis_type_vega/public/data_model/utils.ts	`73.33% <100.00%> (+34.87%)`	⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us.

manasvinibs

LGTM

…lers (#1932) * [CVE] Handle invalid query, index and date in vega charts filter handlers Potential way to prevent XSS vulnerability discovered in the Vega charts OSD integration. CVE link: https://nvd.nist.gov/vuln/detail/CVE-2022-23713 Signed-off-by: Bandini Bhopi <bandinib@amazon.com> * new license header for new files Signed-off-by: Bandini Bhopi <bandinib@amazon.com> Co-authored-by: Kawika Avilla <kavilla414@gmail.com> (cherry picked from commit 9496da3)

…lers (#1932) (#2002) * [CVE] Handle invalid query, index and date in vega charts filter handlers Potential way to prevent XSS vulnerability discovered in the Vega charts OSD integration. CVE link: https://nvd.nist.gov/vuln/detail/CVE-2022-23713 Signed-off-by: Bandini Bhopi <bandinib@amazon.com> * new license header for new files Signed-off-by: Bandini Bhopi <bandinib@amazon.com> Co-authored-by: Kawika Avilla <kavilla414@gmail.com> (cherry picked from commit 9496da3) Co-authored-by: Bandini <63824432+bandinib-amzn@users.noreply.github.com>

…lers (#1932) * [CVE] Handle invalid query, index and date in vega charts filter handlers Potential way to prevent XSS vulnerability discovered in the Vega charts OSD integration. CVE link: https://nvd.nist.gov/vuln/detail/CVE-2022-23713 Signed-off-by: Bandini Bhopi <bandinib@amazon.com> * new license header for new files Signed-off-by: Bandini Bhopi <bandinib@amazon.com> Co-authored-by: Kawika Avilla <kavilla414@gmail.com>

…lers (opensearch-project#1932) * [CVE] Handle invalid query, index and date in vega charts filter handlers Potential way to prevent XSS vulnerability discovered in the Vega charts OSD integration. CVE link: https://nvd.nist.gov/vuln/detail/CVE-2022-23713 Signed-off-by: Bandini Bhopi <bandinib@amazon.com> * new license header for new files Signed-off-by: Bandini Bhopi <bandinib@amazon.com> Co-authored-by: Kawika Avilla <kavilla414@gmail.com>

…lers (#1932) * [CVE] Handle invalid query, index and date in vega charts filter handlers Potential way to prevent XSS vulnerability discovered in the Vega charts OSD integration. CVE link: https://nvd.nist.gov/vuln/detail/CVE-2022-23713 Signed-off-by: Bandini Bhopi <bandinib@amazon.com> * new license header for new files Signed-off-by: Bandini Bhopi <bandinib@amazon.com> Co-authored-by: Kawika Avilla <kavilla414@gmail.com> (cherry picked from commit 9496da3)

…lers (#1932) (#2001) * [CVE] Handle invalid query, index and date in vega charts filter handlers Potential way to prevent XSS vulnerability discovered in the Vega charts OSD integration. CVE link: https://nvd.nist.gov/vuln/detail/CVE-2022-23713 Signed-off-by: Bandini Bhopi <bandinib@amazon.com> * new license header for new files Signed-off-by: Bandini Bhopi <bandinib@amazon.com> Co-authored-by: Kawika Avilla <kavilla414@gmail.com> (cherry picked from commit 9496da3) Co-authored-by: Bandini <63824432+bandinib-amzn@users.noreply.github.com>

…lers (#1932) (#2191) * [CVE] Handle invalid query, index and date in vega charts filter handlers Potential way to prevent XSS vulnerability discovered in the Vega charts OSD integration. CVE link: https://nvd.nist.gov/vuln/detail/CVE-2022-23713 Signed-off-by: Bandini Bhopi <bandinib@amazon.com> * new license header for new files Signed-off-by: Bandini Bhopi <bandinib@amazon.com> Co-authored-by: Kawika Avilla <kavilla414@gmail.com> (cherry picked from commit 9496da3) Co-authored-by: Bandini <63824432+bandinib-amzn@users.noreply.github.com>

[CVE] Handle invalid query, index and date in vega charts filter hand…

a2870ab

…lers Potential way to prevent XSS vulnerability discovered in the Vega charts OSD integration. CVE link: https://nvd.nist.gov/vuln/detail/CVE-2022-23713 Signed-off-by: Bandini Bhopi <bandinib@amazon.com>

bandinib-amzn marked this pull request as ready for review July 22, 2022 22:19

bandinib-amzn requested a review from a team as a code owner July 22, 2022 22:19

bandinib-amzn self-assigned this Jul 22, 2022

bandinib-amzn added medium severity Medium severity CVE cve Security vulnerabilities detected by Dependabot or Mend labels Jul 22, 2022

seraphjiang requested a review from ZilongX July 22, 2022 23:08

kavilla reviewed Jul 24, 2022

View reviewed changes

Comment thread packages/osd-std/src/validate_object.test.ts

Comment thread packages/osd-std/src/validate_object.ts Outdated

Comment thread src/plugins/vis_type_vega/public/data_model/utils.test.js Outdated

bandinib-amzn and others added 2 commits July 26, 2022 19:10

new license header for new files

a21a7a0

Signed-off-by: Bandini Bhopi <bandinib@amazon.com>

Merge branch 'main' into vega-charts-cve

995df04

bandinib-amzn requested a review from kavilla July 26, 2022 23:20

manasvinibs approved these changes Jul 26, 2022

View reviewed changes

bandinib-amzn added the backport 1.x label Jul 26, 2022

kavilla added backport 2.x v2.2.0 labels Jul 27, 2022

ZilongX approved these changes Jul 28, 2022

View reviewed changes

ananzh merged commit 9496da3 into opensearch-project:main Jul 28, 2022

opensearch-trigger-bot bot mentioned this pull request Jul 28, 2022

[Backport 1.x] [CVE] Handle invalid query, index and date in vega charts filter handlers #2001

Merged

opensearch-trigger-bot bot mentioned this pull request Jul 28, 2022

[Backport 2.x] [CVE] Handle invalid query, index and date in vega charts filter handlers #2002

Merged

bandinib-amzn deleted the vega-charts-cve branch August 2, 2022 05:09

kavilla added the backport 1.3 label Aug 23, 2022

opensearch-trigger-bot bot mentioned this pull request Aug 23, 2022

[Backport 1.3] [CVE] Handle invalid query, index and date in vega charts filter handlers #2191

Merged

joshuarrrr added the v1.3.6 label Apr 19, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[CVE] Handle invalid query, index and date in vega charts filter handlers#1932

[CVE] Handle invalid query, index and date in vega charts filter handlers#1932
ananzh merged 3 commits intoopensearch-project:mainfrom
bandinib-amzn:vega-charts-cve

bandinib-amzn commented Jul 22, 2022

Uh oh!

kavilla left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov-commenter commented Jul 26, 2022

Uh oh!

manasvinibs left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Conversation

bandinib-amzn commented Jul 22, 2022

Description

Check List

Uh oh!

kavilla left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov-commenter commented Jul 26, 2022

Codecov Report

Uh oh!

manasvinibs left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

kavilla left a comment •

edited

Loading