Skip to content

Commit 84b526e

Browse files
Merge branch 'master' into vis-types-2
2 parents 5c766c1 + 31057f7 commit 84b526e

File tree

189 files changed

+5424
-2738
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

189 files changed

+5424
-2738
lines changed

.github/CODEOWNERS

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -439,6 +439,9 @@
439439
/x-pack/test/reporting_api_integration/ @elastic/kibana-reporting-services @elastic/kibana-app-services
440440
/x-pack/test/reporting_functional/ @elastic/kibana-reporting-services @elastic/kibana-app-services
441441
/x-pack/test/stack_functional_integration/apps/reporting/ @elastic/kibana-reporting-services @elastic/kibana-app-services
442+
/docs/user/reporting @elastic/kibana-reporting-services @elastic/kibana-app-services
443+
/docs/settings/reporting-settings.asciidoc @elastic/kibana-reporting-services @elastic/kibana-app-services
444+
/docs/setup/configuring-reporting.asciidoc @elastic/kibana-reporting-services @elastic/kibana-app-services
442445
#CC# /x-pack/plugins/reporting/ @elastic/kibana-reporting-services
443446

444447

docs/management/advanced-options.asciidoc

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,7 @@ Set to `true` to enable a dark mode for the {kib} UI. You must refresh the page
186186
to apply the setting.
187187

188188
[[theme-version]]`theme:version`::
189-
Specifies the {kib} theme. If you change the setting, refresh the page to apply the setting.
189+
Specifies the {kib} theme. If you change the setting, refresh the page to apply the setting.
190190

191191
[[timepicker-quickranges]]`timepicker:quickRanges`::
192192
The list of ranges to show in the Quick section of the time filter. This should
@@ -214,7 +214,7 @@ truncation.
214214
When enabled, provides access to the experimental *Labs* features for *Canvas*.
215215

216216
[[labs-dashboard-defer-below-fold]]`labs:dashboard:deferBelowFold`::
217-
When enabled, the panels that appear below the fold are loaded when they become visible on the dashboard.
217+
When enabled, the panels that appear below the fold are loaded when they become visible on the dashboard.
218218
_Below the fold_ refers to panels that are not immediately visible when you open a dashboard, but become visible as you scroll. For additional information, refer to <<defer-loading-panels-below-the-fold,Improve dashboard loading time>>.
219219

220220
[[labs-dashboard-enable-ui]]`labs:dashboard:enable_ui`::
@@ -240,7 +240,7 @@ Banners are a https://www.elastic.co/subscriptions[subscription feature].
240240

241241
[horizontal]
242242
[[banners-placement]]`banners:placement`::
243-
Set to `Top` to display a banner above the Elastic header for this space. Defaults to the value of
243+
Set to `Top` to display a banner above the Elastic header for this space. Defaults to the value of
244244
the `xpack.banners.placement` configuration property.
245245

246246
[[banners-textcontent]]`banners:textContent`::
@@ -443,6 +443,9 @@ The threshold above which {ml} job anomalies are displayed in the {security-app}
443443
A comma-delimited list of {es} indices from which the {security-app} collects
444444
events.
445445

446+
[[securitysolution-threatindices]]`securitySolution:defaultThreatIndex`::
447+
A comma-delimited list of Threat Intelligence indices from which the {security-app} collects indicators.
448+
446449
[[securitysolution-enablenewsfeed]]`securitySolution:enableNewsFeed`:: Enables
447450
the security news feed on the Security *Overview* page.
448451

@@ -544,4 +547,4 @@ only production-ready visualizations are available to users.
544547
[horizontal]
545548
[[telemetry-enabled-advanced-setting]]`telemetry:enabled`::
546549
When enabled, helps improve the Elastic Stack by providing usage statistics for
547-
basic features. This data will not be shared outside of Elastic.
550+
basic features. This data will not be shared outside of Elastic.

docs/settings/reporting-settings.asciidoc

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -281,16 +281,15 @@ NOTE: This setting exists for backwards compatibility, but is unused and hardcod
281281
[[reporting-advanced-settings]]
282282
==== Security settings
283283

284-
[[xpack-reporting-roles-enabled]] `xpack.reporting.roles.enabled`::
285-
deprecated:[7.14.0,This setting must be set to `false` in 8.0.] When `true`, grants users access to the {report-features} by assigning reporting roles, specified by `xpack.reporting.roles.allow`. Granting access to users this way is deprecated. Set to `false` and use {kibana-ref}/kibana-privileges.html[{kib} privileges] instead. Defaults to `true`.
284+
With Security enabled, Reporting has two forms of access control: each user can only access their own reports, and custom roles determine who has privilege to generate reports. When Reporting is configured with <<kibana-privileges, {kib} application privileges>>, you can control the spaces and applications where users are allowed to generate reports.
286285

287286
[NOTE]
288287
============================================================================
289-
In 7.x, the default value of `xpack.reporting.roles.enabled` is `true`. To migrate users to the
290-
new method of securing access to *Reporting*, you must set `xpack.reporting.roles.enabled: false`. In the next major version of {kib}, `false` will be the only valid configuration.
288+
The `xpack.reporting.roles` settings are for a deprecated system of access control in Reporting. It does not allow API Keys to generate reports, and it doesn't allow {kib} application privileges. We recommend you explicitly turn off reporting's deprecated access control feature by adding `xpack.reporting.roles.enabled: false` in kibana.yml. This will enable application privileges for reporting, as described in <<grant-user-access, granting users access to reporting>>.
291289
============================================================================
292290

293-
`xpack.reporting.roles.allow`::
294-
deprecated:[7.14.0,This setting will be removed in 8.0.] Specifies the roles, in addition to superusers, that can generate reports, using the {ref}/security-api.html#security-role-apis[{es} role management APIs]. Requires `xpack.reporting.roles.enabled` to be `true`. Granting access to users this way is deprecated. Use {kibana-ref}/kibana-privileges.html[{kib} privileges] instead. Defaults to `[ "reporting_user" ]`.
291+
[[xpack-reporting-roles-enabled]] `xpack.reporting.roles.enabled`::
292+
deprecated:[7.14.0,The default for this setting will be `false` in an upcoming version of {kib}.] Sets access control to a set of assigned reporting roles, specified by `xpack.reporting.roles.allow`. Defaults to `true`.
295293

296-
NOTE: Each user has access to only their own reports.
294+
`xpack.reporting.roles.allow`::
295+
deprecated:[7.14.0] In addition to superusers, specifies the roles that can generate reports using the {ref}/security-api.html#security-role-apis[{es} role management APIs]. Requires `xpack.reporting.roles.enabled` to be `true`. Defaults to `[ "reporting_user" ]`.

docs/setup/configuring-reporting.asciidoc

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -41,11 +41,16 @@ To troubleshoot the problem, start the {kib} server with environment variables t
4141
[float]
4242
[[grant-user-access]]
4343
=== Grant users access to reporting
44+
When security is enabled, you grant users access to generate reports with <<kibana-privileges, {kib} application privileges>>, which allow you to create custom roles that control the spaces and applications where users generate reports.
4445

45-
When security is enabled, access to the {report-features} is controlled by roles and <<kibana-privileges, privileges>>. With privileges, you can define custom roles that grant *Reporting* privileges as sub-features of {kib} applications. To grant users permission to generate reports and view their reports in *Reporting*, create and assign the reporting role.
46-
47-
[[reporting-app-users]]
48-
NOTE: In 7.12.0 and earlier, you grant access to the {report-features} by assigning users the `reporting_user` role in {es}.
46+
. Enable application privileges in Reporting. To enable, turn off the default user access control features in `kibana.yml`:
47+
+
48+
[source,yaml]
49+
------------------------------------
50+
xpack.reporting.roles.enabled: false
51+
------------------------------------
52+
+
53+
NOTE: If you use the default settings, you can still create a custom role that grants reporting privileges. The default role is `reporting_user`. This behavior is being deprecated and does not allow application-level access controls for {report-features}, and does not allow API keys or authentication tokens to authorize report generation. Refer to <<reporting-advanced-settings, reporting security settings>> for information and caveats about the deprecated access control features.
4954

5055
. Create the reporting role.
5156

@@ -90,10 +95,12 @@ If the *Reporting* option is unavailable, contact your administrator, or <<repor
9095

9196
.. Click *Update user*.
9297

98+
Granting the privilege to generate reports also grants the user the privilege to view their reports in *Stack Management > Reporting*. Users can only access their own reports.
99+
93100
[float]
94101
[[reporting-roles-user-api]]
95102
==== Grant access with the role API
96-
You can also use the {ref}/security-api-put-role.html[role API] to grant access to the reporting features. Grant the reporting role to users in combination with other roles that grant read access to the data in {es}, and at least read access in the applications where users can generate reports.
103+
With <<grant-user-access, {kib} application privileges>> enabled in Reporting, you can also use the {ref}/security-api-put-role.html[role API] to grant access to the {report-features}. Grant custom reporting roles to users in combination with other roles that grant read access to the data in {es}, and at least read access in the applications where users can generate reports.
97104

98105
[source, sh]
99106
---------------------------------------------------------------

package.json

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -655,6 +655,7 @@
655655
"@types/yauzl": "^2.9.1",
656656
"@types/zen-observable": "^0.8.0",
657657
"@typescript-eslint/eslint-plugin": "^4.14.1",
658+
"@typescript-eslint/typescript-estree": "^4.14.1",
658659
"@typescript-eslint/parser": "^4.14.1",
659660
"@yarnpkg/lockfile": "^1.1.0",
660661
"abab": "^2.0.4",
@@ -725,6 +726,7 @@
725726
"eslint-plugin-react": "^7.20.3",
726727
"eslint-plugin-react-hooks": "^4.2.0",
727728
"eslint-plugin-react-perf": "^3.2.3",
729+
"eslint-traverse": "^1.0.0",
728730
"expose-loader": "^0.7.5",
729731
"faker": "^5.1.0",
730732
"fancy-log": "^1.3.2",

packages/elastic-eslint-config-kibana/.eslintrc.js

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,5 +90,7 @@ module.exports = {
9090
},
9191
],
9292
],
93+
94+
'@kbn/eslint/no_async_promise_body': 'error',
9395
},
9496
};

packages/kbn-eslint-plugin-eslint/index.js

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,5 +12,6 @@ module.exports = {
1212
'disallow-license-headers': require('./rules/disallow_license_headers'),
1313
'no-restricted-paths': require('./rules/no_restricted_paths'),
1414
module_migration: require('./rules/module_migration'),
15+
no_async_promise_body: require('./rules/no_async_promise_body'),
1516
},
1617
};
Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License
4+
* 2.0 and the Server Side Public License, v 1; you may not use this file except
5+
* in compliance with, at your election, the Elastic License 2.0 or the Server
6+
* Side Public License, v 1.
7+
*/
8+
9+
const { parseExpression } = require('@babel/parser');
10+
const { default: generate } = require('@babel/generator');
11+
const tsEstree = require('@typescript-eslint/typescript-estree');
12+
const traverse = require('eslint-traverse');
13+
const esTypes = tsEstree.AST_NODE_TYPES;
14+
const babelTypes = require('@babel/types');
15+
16+
/** @typedef {import("eslint").Rule.RuleModule} Rule */
17+
/** @typedef {import("@typescript-eslint/parser").ParserServices} ParserServices */
18+
/** @typedef {import("@typescript-eslint/typescript-estree").TSESTree.Expression} Expression */
19+
/** @typedef {import("@typescript-eslint/typescript-estree").TSESTree.ArrowFunctionExpression} ArrowFunctionExpression */
20+
/** @typedef {import("@typescript-eslint/typescript-estree").TSESTree.FunctionExpression} FunctionExpression */
21+
/** @typedef {import("@typescript-eslint/typescript-estree").TSESTree.TryStatement} TryStatement */
22+
/** @typedef {import("@typescript-eslint/typescript-estree").TSESTree.NewExpression} NewExpression */
23+
/** @typedef {import("typescript").ExportDeclaration} ExportDeclaration */
24+
/** @typedef {import("eslint").Rule.RuleFixer} Fixer */
25+
26+
const ERROR_MSG =
27+
'Passing an async function to the Promise constructor leads to a hidden promise being created and prevents handling rejections';
28+
29+
/**
30+
* @param {Expression} node
31+
*/
32+
const isPromise = (node) => node.type === esTypes.Identifier && node.name === 'Promise';
33+
34+
/**
35+
* @param {Expression} node
36+
* @returns {node is ArrowFunctionExpression | FunctionExpression}
37+
*/
38+
const isFunc = (node) =>
39+
node.type === esTypes.ArrowFunctionExpression || node.type === esTypes.FunctionExpression;
40+
41+
/**
42+
* @param {any} context
43+
* @param {ArrowFunctionExpression | FunctionExpression} node
44+
*/
45+
const isFuncBodySafe = (context, node) => {
46+
// if the body isn't wrapped in a blockStatement it can't have a try/catch at the root
47+
if (node.body.type !== esTypes.BlockStatement) {
48+
return false;
49+
}
50+
51+
// when the entire body is wrapped in a try/catch it is the only node
52+
if (node.body.body.length !== 1) {
53+
return false;
54+
}
55+
56+
const tryNode = node.body.body[0];
57+
// ensure we have a try node with a handler
58+
if (tryNode.type !== esTypes.TryStatement || !tryNode.handler) {
59+
return false;
60+
}
61+
62+
// ensure the handler doesn't throw
63+
let hasThrow = false;
64+
traverse(context, tryNode.handler, (path) => {
65+
if (path.node.type === esTypes.ThrowStatement) {
66+
hasThrow = true;
67+
return traverse.STOP;
68+
}
69+
});
70+
return !hasThrow;
71+
};
72+
73+
/**
74+
* @param {string} code
75+
*/
76+
const wrapFunctionInTryCatch = (code) => {
77+
// parse the code with babel so we can mutate the AST
78+
const ast = parseExpression(code, {
79+
plugins: ['typescript', 'jsx'],
80+
});
81+
82+
// validate that the code reperesents an arrow or function expression
83+
if (!babelTypes.isArrowFunctionExpression(ast) && !babelTypes.isFunctionExpression(ast)) {
84+
throw new Error('expected function to be an arrow or function expression');
85+
}
86+
87+
// ensure that the function receives the second argument, and capture its name if already defined
88+
let rejectName = 'reject';
89+
if (ast.params.length === 0) {
90+
ast.params.push(babelTypes.identifier('resolve'), babelTypes.identifier(rejectName));
91+
} else if (ast.params.length === 1) {
92+
ast.params.push(babelTypes.identifier(rejectName));
93+
} else if (ast.params.length === 2) {
94+
if (babelTypes.isIdentifier(ast.params[1])) {
95+
rejectName = ast.params[1].name;
96+
} else {
97+
throw new Error('expected second param of promise definition function to be an identifier');
98+
}
99+
}
100+
101+
// ensure that the body of the function is a blockStatement
102+
let block = ast.body;
103+
if (!babelTypes.isBlockStatement(block)) {
104+
block = babelTypes.blockStatement([babelTypes.returnStatement(block)]);
105+
}
106+
107+
// redefine the body of the function as a new blockStatement containing a tryStatement
108+
// which catches errors and forwards them to reject() when caught
109+
ast.body = babelTypes.blockStatement([
110+
// try {
111+
babelTypes.tryStatement(
112+
block,
113+
// catch (error) {
114+
babelTypes.catchClause(
115+
babelTypes.identifier('error'),
116+
babelTypes.blockStatement([
117+
// reject(error)
118+
babelTypes.expressionStatement(
119+
babelTypes.callExpression(babelTypes.identifier(rejectName), [
120+
babelTypes.identifier('error'),
121+
])
122+
),
123+
])
124+
)
125+
),
126+
]);
127+
128+
return generate(ast).code;
129+
};
130+
131+
/** @type {Rule} */
132+
module.exports = {
133+
meta: {
134+
fixable: 'code',
135+
schema: [],
136+
},
137+
create: (context) => ({
138+
NewExpression(_) {
139+
const node = /** @type {NewExpression} */ (_);
140+
141+
// ensure we are newing up a promise with a single argument
142+
if (!isPromise(node.callee) || node.arguments.length !== 1) {
143+
return;
144+
}
145+
146+
const func = node.arguments[0];
147+
// ensure the argument is an arrow or function expression and is async
148+
if (!isFunc(func) || !func.async) {
149+
return;
150+
}
151+
152+
// body must be a blockStatement, try/catch can't exist outside of a block
153+
if (!isFuncBodySafe(context, func)) {
154+
context.report({
155+
message: ERROR_MSG,
156+
loc: func.loc,
157+
fix(fixer) {
158+
const source = context.getSourceCode();
159+
return fixer.replaceText(func, wrapFunctionInTryCatch(source.getText(func)));
160+
},
161+
});
162+
}
163+
},
164+
}),
165+
};

0 commit comments

Comments
 (0)