Remove usage of Lodash template
#10920
Conversation
Signed-off-by: Paul Sebastian <[email protected]>
Signed-off-by: Paul Sebastian <[email protected]>
Signed-off-by: Paul Sebastian <[email protected]>
Signed-off-by: Paul Sebastian <[email protected]>
❌ Empty Changelog SectionThe Changelog section in your PR description is empty. Please add a valid changelog entry or entries. If you did add a changelog entry, check to make sure that it was not accidentally included inside the comment block in the Changelog section. |
Signed-off-by: Paul Sebastian <[email protected]>
| ); | ||
| }); | ||
|
|
||
| describe('templateHtml rendering', () => { |
There was a problem hiding this comment.
Adds in tests for testing the output of htmlConvert within source.ts, since this wasn't in there beforehand.
paulstn
requested review from
AMoo-Miki,
BionIT,
Flyingliuhub,
SuZhou-Joe,
ZilongX,
abbyhu2000,
ananzh,
ashwin-pc,
bandinib-amzn,
curq,
joshuarrrr,
kavilla,
manasvinibs,
ruanyl,
zengyan-amazon and
zhongnansu
as code owners
paulstn
requested review from
LDrago27,
Maosaic,
TackAdam,
angle943,
d-buckner,
huyaboo,
joshuali925,
mengweieric,
ps48,
raintygao,
ruchidh,
sejli,
sumukhswamy,
virajsanghvi,
wanglam,
xinruiba and
zhyuanqi
as code owners
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #10920 +/- ##
==========================================
+ Coverage 60.75% 60.78% +0.03%
==========================================
Files 4533 4531 -2
Lines 122211 122219 +8
Branches 20483 20488 +5
==========================================
+ Hits 74250 74292 +42
+ Misses 42720 42689 -31
+ Partials 5241 5238 -3
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| ${wholeBucket ? 'Part of this bucket' : 'This area'} | ||
| may contain partial data. The selected time range does not fully cover it. | ||
| </span> | ||
| </p>`; |
There was a problem hiding this comment.
were u able to test this visually by any chance?
angle943
left a comment
angle943
left a comment
There was a problem hiding this comment.
change looks good, thanks! One note is that CIs are failing, but i don't believe it is related to this change. We have a chat started in the OSD maintainer channel to look into it
2 participants
Description
The overall goal of this PR is to not use lodash
templateanymore, since it uses theFunctionconstructor, which violates thescript-src 'unsafe-eval'directive due to it executing dynamically generated code.Put in ES Lint rules
Errors will be thrown if lodash
templateis used in any capacity.Remove the use of lodash
templateDid this within
color.ts,source.ts, andpoint_series.js, replacing the used template with working code that has the same functionality.Remove lodash.template security hardening module
Removed
src/setup_node_env/harden/lodash_template.js- Security hardening wrappertest/harden/lodash_template.js- Associated test filesrc/setup_node_env/harden/index.jsWhy it's safe to remove
These files implemented runtime security hardening for
lodash.template, which is a knownsecurity risk when used with user input. However:
lodash.templateis not used anywhere in the OpenSearchDashboards codebase
lodash.templatewith the message "lodash.template is not allowed due to securityconcerns"
level and has zero usage, runtime hardening provides no additional value
The security protections remain in place through ESLint rules, which prevent the
vulnerable function from being introduced in the first place.
Testing the changes
Added or used relevant tests to ensure the behavior remains the same with the
Changelog
Check List
yarn test:jestyarn test:jest_integration