Skip to content

[Security Solution] Filename on value list import is stored in URI encoded form #93346

@marshallmain

Description

@marshallmain

Kibana version:
8.0.0

Describe the bug:
When importing value lists through the UI, the file is uploaded and the filename is URI encoded during the upload. The filename is then used as the value list ID, however the filename is not URI decoded before being stored, thus a filename that includes quotes like "Untitled".txt is stored as %22Untitled%22.txt. Since it's stored this way, when it comes back to the UI it's displayed in this encoded form as well.

Steps to reproduce:

  1. Upload a value list with one or more quotes in the filename
  2. Observe that the quotes are replaced with %22 when viewing the value list in the UI

Expected behavior:
Quotes should be preserved in the filename.
We likely need to add a call to decodeURIComponent on this line, however we should also ensure that these IDs are properly escaped when used in other places - particularly for generating KQL queries. This PR addresses some places where IDs were being used without escaping, but there could be others.

Metadata

Metadata

Assignees

Labels

Team: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detections and RespSecurity Detection Response TeambugFixes for quality problems that affect the customer experienceimpact:mediumAddressing this issue will have a medium level of impact on the quality/strength of our product.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions