Allow additive csp configuration #102059

pgayvallet · 2021-06-14T13:22:43Z

Summary

Add per-directive configuration to the csp config:
- csp.script_src
- csp.worker_src
- csp.style_src
- csp.connect_src
- csp.default_src
- csp.font_src
- csp.frame_src
- csp.image_src
- csp.frame_ancestors
- csp.report_uri
- csp.report_to
Deprecates csp.rules in favor of per-directive configuration

Release notes

The csp.rules configuration property is deprecated in favor of directive specific configuration. csp.script_src, csp.worker_src and csp.style_src should now be used instead. Note that setting the default Kibana values is no longer required.

csp.rules:
  - script-src 'unsafe-eval' 'self' https://mycdn.com/script.js
  - "worker-src blob: 'self' https://mycdn.com/worker.js"
  - style-src 'unsafe-inline' 'self' https://mycdn.com/style.css

would have to be converted to

csp:
  script_src:
    - https://mycdn.com/script.js
  worker_src:
    - https://mycdn.com/worker.js
  style_src:
    - https://mycdn.com/style.css

Checklist

Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios

…e-csp

pgayvallet

Self review

~~Question: was our csp configuration documented anywhere (to update it)?~~

pgayvallet · 2021-06-15T05:58:11Z

src/core/server/csp/config.ts

+      if (
+        cspConfig.rules &&
+        (cspConfig.script_src.length || cspConfig.worker_src.length || cspConfig.style_src.length)
+      ) {
+        return `"csp.rules" cannot be used when specifying per-directive additions such as "script_src", "worker_src" or "style_src"`;
+      }


Forbidding both usages simultaneously was what we talked about. Technically we could allow it, as the new CspDirectives system could merge both sources though, but it's probably better to just not mix things

pgayvallet · 2021-06-15T05:59:15Z

src/core/server/csp/config.ts

+            'csp.rules is deprecated in favor of per-directive definitions. ' +
+            'Please use `csp.script_src`, `csp.worker_src` and `csp.style_src` instead',
+          correctiveActions: {
+            manualSteps: [
+              `Remove "csp.rules" from the Kibana config file"`,
+              `Add per-directive definitions to the config file, using "csp.script_src", "csp.worker_src" and "csp.style_src"`,


Not sure it's the best wording, suggestions welcome

pgayvallet · 2021-06-15T06:19:43Z

src/core/server/csp/csp_config.test.ts

+    test('allows "worker_src" to be set and changes header', () => {
+      const config = new CspConfig({
+        ...defaultConfig,
+        rules: [],
+        worker_src: ['foo', 'bar'],


These tests are effectively mostly testing the CspDirectives class, but I thought it made sense to still test the config configuration / behavior without mocking the underlying implementation (to preserve the implementation during test isolation)

pgayvallet · 2021-06-15T06:21:23Z

src/core/server/csp/csp_config.ts

-    this.disableEmbedding = source.disableEmbedding;
-    if (!rawCspConfig.rules?.length && source.disableEmbedding) {
-      this.rules.push(FRAME_ANCESTORS_RULE);
+  constructor(rawCspConfig: CspConfigType) {


The partial constructor thingy was just a workaround to instantiate the default config. Adapted for better consistency with our other config classes (and also because it didn't make a lot of sense imho)

pgayvallet · 2021-06-15T06:22:18Z

src/core/server/csp/csp_config.ts

+    if (!rawCspConfig.rules?.length && rawCspConfig.disableEmbedding) {
+      this.#directives.addDirectiveValue('frame-ancestors', `'self'`);
    }


Now that we're supporting additive config, I'm not sure the rawCspConfig.rules?.length part of the if condition makes sense, as we're now capable of adding additional rules even if frame-ancestors is already specified. WDYT?

pgayvallet · 2021-06-15T06:23:39Z

src/core/server/csp/csp_directives.ts

+    if (!this.directives.has(directiveName)) {
+      this.directives.set(directiveName, new Set());
+    }
+    this.directives.get(directiveName)!.add(directiveValue);


Using a Set here to 'silently' remove potential duplicates. Felt like it made more sense than throwing in that case.

pgayvallet · 2021-06-15T06:25:44Z

src/core/server/http/cookie_session_storage.test.ts

-    return new BehaviorSubject({} as any);
+    return new BehaviorSubject({
+      script_src: [],
+      worker_src: [],
+      style_src: [],
+      strict: false,
+      disableEmbedding: false,


Not specifying script_src and others was causing a NPE in csp_directives.ts#L47. As these properties are not optional in the config, I thought it made more sense to adapt the test configs instead of adding test-specific logic in the code.

pgayvallet · 2021-06-15T06:27:05Z

src/plugins/kibana_usage_collection/server/collectors/csp/csp_collector.test.ts

-    httpMock.csp = new CspConfig(config);
+    httpMock.csp = new CspConfig({
+      ...CspConfig.DEFAULT,
+      style_src: [],
+      worker_src: [],
+      script_src: [],
+      ...config,
+    });


Not really proud of that, but the alternative was to publicly expose the CspConfigType type from core just for that, and it felt worse.

elasticmachine · 2021-06-15T07:06:56Z

Pinging @elastic/kibana-core (Team:Core)

joshdover

LGTM, a few comments to consider

src/core/server/csp/csp_directives.ts

src/core/server/csp/csp_directives.test.ts

joshdover · 2021-06-15T11:54:00Z

src/core/server/csp/csp_config.ts

+    this.header = this.#directives.getCspHeader();
+
+    this.strict = rawCspConfig.strict;
+    this.warnLegacyBrowsers = rawCspConfig.warnLegacyBrowsers;


Note to self: we can probably remove this warning feature now that we no longer support IE11

src/core/server/csp/config.ts

joshdover · 2021-06-15T12:40:51Z

I believe this PR needs a release_note:deprecation label + release note in the description as well. We also need to update the asciidoc documentation (which I see you have unchecked above)

…e-csp

jportner

In addition to the comments below:

Using a token of 'none' for any of these three directives will have no effect, since we already have other directive values that supersede it. Perhaps we should add validation to throw an error if this token is used?

All keyword values and unsafe keyword values need to be surrounded by single quotes to have any effect in the client. I can imagine this could be a point of confusion for users. Perhaps we should check for these 8 tokens and wrap them in single quotes for a better user experience? For example:

const KEYWORD_TOKENS = ['none', 'self', 'strict-dynamic', 'report-sample', 'unsafe-inline', 'unsafe-eval', 'unsafe-hashes', 'unsafe-allow-redirects'];
function normalizeDirectiveValue(value: string) {
  if (KEYWORD_TOKENS.includes(value)) {
    return `'${value}'`;
  }
  return value;
}

According to Add nonce- to our CSP policy to allow inlining bootstrap.js inside the application document #93785, we eventually want to add a nonce-* value. In addition to that, we probably don't want to allow users to configure a static nonce in YML as that is insecure. Perhaps we should add validation to throw an error if any string starting with nonce- is used?

docs/setup/settings.asciidoc

src/core/server/csp/config.ts

pgayvallet · 2021-06-15T18:13:49Z

Using a token of 'none' for any of these three directives will have no effect, since we already have other directive values that supersede it. Perhaps we should add validation to throw an error if this token is used?

Yea, OTOH using none would just break Kibana anyway. Should we add validation for every chair-keyboard interface based problems. But can do if you think this is necessary

All keyword values and unsafe keyword values need to be surrounded by single quotes to have any effect in the client. I can imagine this could be a point of confusion for users

I'm mixed. It indeed it a confusion, but OTOH this is nothing new compared to how csp.rules is currently behaving. However I don't see any downside trying to be 'smart', so we could do it.

According to #93785, we eventually want to add a nonce-* value. In addition to that, we probably don't want to allow users to configure a static nonce in YML as that is insecure. Perhaps we should add validation to throw an error if any string starting with nonce- is used?

If you think this is better in term of security, I have no objections.

should this be done for all directives
do you see any other special values that should be forbidden from the configuration file?

jportner · 2021-06-15T18:35:39Z

Yea, OTOH using none would just break Kibana anyway. Should we add validation for every chair-keyboard interface based problems. But can do if you think this is necessary

Let me elaborate a bit more. My testing was with Chrome, and the CSP was:
content-security-policy: script-src 'unsafe-eval' 'self' 'none'; ...

It didn't have any effect. But I'm not sure how other browsers will interpret it; the way I read the standard, a directive value of 'self' + 'none' should be interpreted as 'self', but we can't be 100% sure that every browser will behave according to spec.

No, I don't think we should add validation for everything under the sun, but we can do a bare minimum to prevent users from accidentally misusing the eight different CSP keyword values. In particular for this keyword, there's a risk that users could add 'none' and get into a situation where Kibana works on Chrome but not on another browser. Since we don't ever expect Kibana to work with 'none' for these three directives, it seems like an easy foot-gun to avoid.

I'm mixed. It indeed it a confusion, but OTOH this is nothing new compared to how csp.rules is currently behaving. However I don't see any downside trying to be 'smart', so we could do it.

Yeah, the difference is you need to configure a whole directive for csp.rules so it's more evident what you're writing, especially if you're copy/pasting from somewhere, e.g.,

csp.rules: "script-src 'self' https://example.com"

vs

csp.script_src: ['self', 'https://example.com']

I've seen several SDH issues where users misunderstand basic YAML syntax, so this seems like low-hanging fruit for us to avoid issues.

If you think this is better in term of security, I have no objections.

should this be done for all directives

do you see any other special values that should be forbidden from the configuration file?

Yes, I can't see any reason not to do this for all directives
No, I don't see any other problematic values

…e-csp

pgayvallet

@jportner I added the missing directives listed in #102322, and the missing validation.

The only thing I couldn't easily add it the validation of the interaction between csp.frame-ancestors and server.securityResponseHeaders.disableEmbedding, for the simple reason that these are in distinct root config schema, meaning that we can't throw during config validation.

I could eventually throw during the CspConfig construction, as the disableEmbedding value is passed from from the HttpConfig, however this is non-standard, as config validation is supposed to be done from the schema.

We were think to move the csp config to server.csp at some point, which would allow to perform such validation from within the server validation. If that's alright with you, I'd rather open a follow-up to handle this config interaction once this moving is done.

PTAL

pgayvallet · 2021-06-23T08:44:45Z

src/core/server/csp/config.ts

+    style_src: schema.arrayOf(schema.string(), {
+      defaultValue: [],
+      validate: getDirectiveValidator({ allowNone: false, allowNonce: false }),
+    }),
+    connect_src: schema.arrayOf(schema.string(), {
+      defaultValue: [],
+      validate: getDirectiveValidator({ allowNone: true, allowNonce: false }),
+    }),


As discussed:

we're forbidding nonce- for all directives

we're forbidding none for the 3 directives with default values (script-src, worker-src, style-src)

pgayvallet · 2021-06-23T08:45:29Z

src/core/server/csp/config.ts

+      if (
+        cspConfig.strict &&
+        (cspConfig.script_src.includes(`unsafe-inline`) ||
+          cspConfig.script_src.includes(`'unsafe-inline'`))
+      ) {
+        return 'cannot use `unsafe-inline` for `script_src` when `csp.strict` is true';
+      }


Throwing when using unsafe-inline for script-src in strict mode

pgayvallet · 2021-06-23T08:49:15Z

src/core/server/csp/csp_directives.ts

+/**
+ * Per-directive rules that will be added when the configuration contains at least one value
+ * Main purpose is to add `self` value to some directives when the configuration specifies other values
+ */
+export const additionalRules: Partial<Record<CspDirectiveName, string[]>> = {
+  'connect-src': [`'self'`],
+  'default-src': [`'self'`],
+  'font-src': [`'self'`],
+  'img-src': [`'self'`],
+};


We can't add new default rules for these directive, as it will be a breaking change, however we want to add self when the customer configure another source, to still allow to fetch from our server.

E.g if the customer configures csp.img_src: ['foo.com'], we'll be effectively using img-src: 'self' foo.com

jportner

Overall looking great, thanks for making all of the changes requested and I apologize this has turned out to be a bigger PR than intended!

We were think to move the csp config to server.csp at some point, which would allow to perform such validation from within the server validation. If that's alright with you, I'd rather open a follow-up to handle this config interaction once this moving is done.

Sounds good.

A few more concerns/nits below.

Also, don't forget to add these new config values to src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker before merging, and I guess we'll need a follow-on PR to allow these to be set in Cloud too.

src/core/server/csp/csp_config.ts

docs/setup/settings.asciidoc

src/core/server/csp/config.ts

…e-csp

jbudz

kibana-docker LGTM

jportner

One last nit below, other than that LGTM! 🙌

src/core/server/csp/config.test.ts

…e-csp

kibanamachine · 2021-06-25T14:18:09Z

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`core`	1054	1055	+1

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`core`	29	30	+1

Unknown metric groups

API count

id	before	after	diff
`core`	2283	2284	+1

History

💚 Build #133923 succeeded fff64d8
💚 Build #133908 succeeded e9590d4
💚 Build #133902 succeeded 04a4f59
💔 Build #133423 failed c74ada5
💚 Build #133428 succeeded 59303f4

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* add additive csp configuration * add unit tests for new class * fix types * adapt test utils * fix tests * more unit tests on config * generated doc * review comments * update ascii doc * update ascii doc links * automatically add single quotes for keywords * add missing csp directives * add more tests * add additional settings to asciidoc * add null-check * revert test config props * fix usage collection usage * some review comments * last review comments * add kibana-docker variables * try to fix doc reference * try to fix doc reference again * fix tests # Conflicts: # src/core/server/csp/config.ts # src/core/server/csp/csp_config.test.ts

…-png-pdf-report-type * 'master' of github.com:elastic/kibana: (253 commits) [Enterprise Search] Test coverage pass (elastic#103406) [App Search] Success toast polish pass (elastic#103410) Role mappings: remove deprecated reset copy (elastic#103411) [Fleet] Add a message when log collection is disabled on the log details page (elastic#103166) [Query] Remove es query dependency on format.convert (elastic#103174) Home & Kibana Overview Page Template Update (elastic#103003) [ML] Converts management app jobs list pages to new layout (elastic#103117) Allow additive csp configuration (elastic#102059) [Lens] Document common formulas in product and add formula tutorial (elastic#103154) [Lens] Enable actions on Lens Embeddable (elastic#102038) [Osquery] Return proper indices permissions for osquery_manager package (elastic#103363) Dashboard locator (elastic#102854) Maps locators (elastic#102810) [Fleet] Add support for constant_keyword "value" in package field definitions (elastic#103000) [Maps] Add capability to delete features from layer & index (elastic#103145) [Security Solution] Correct linux OS lookup for Endpoint Exceptions (elastic#103038) [Enterprise Search] Add notices for deactivated users and SMTP callout (elastic#103285) [canvas] Reduce bundle size by combining SCSS imports (elastic#102822) [Enterprise Search] Final KibanaPageTemplate cleanup (elastic#103355) [docs][migrations v2] Update SO migration docs to include removal of index write block when handling corrupt SOs. (elastic#103014) ...

…-policy-2 * 'master' of github.com:elastic/kibana: (190 commits) [Enterprise Search] Test coverage pass (elastic#103406) [App Search] Success toast polish pass (elastic#103410) Role mappings: remove deprecated reset copy (elastic#103411) [Fleet] Add a message when log collection is disabled on the log details page (elastic#103166) [Query] Remove es query dependency on format.convert (elastic#103174) Home & Kibana Overview Page Template Update (elastic#103003) [ML] Converts management app jobs list pages to new layout (elastic#103117) Allow additive csp configuration (elastic#102059) [Lens] Document common formulas in product and add formula tutorial (elastic#103154) [Lens] Enable actions on Lens Embeddable (elastic#102038) [Osquery] Return proper indices permissions for osquery_manager package (elastic#103363) Dashboard locator (elastic#102854) Maps locators (elastic#102810) [Fleet] Add support for constant_keyword "value" in package field definitions (elastic#103000) [Maps] Add capability to delete features from layer & index (elastic#103145) [Security Solution] Correct linux OS lookup for Endpoint Exceptions (elastic#103038) [Enterprise Search] Add notices for deactivated users and SMTP callout (elastic#103285) [canvas] Reduce bundle size by combining SCSS imports (elastic#102822) [Enterprise Search] Final KibanaPageTemplate cleanup (elastic#103355) [docs][migrations v2] Update SO migration docs to include removal of index write block when handling corrupt SOs. (elastic#103014) ... # Conflicts: # x-pack/plugins/reporting/server/lib/store/store.test.ts # x-pack/plugins/reporting/server/lib/store/store.ts

commit 1159e58 Merge: 8011451 df8787b Author: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Date: Sat Jun 26 09:54:54 2021 -0400 Merge branch 'master' into apm-tutorial-token commit df8787b Author: Michael Marcialis <michael.marcialis@elastic.co> Date: Fri Jun 25 20:58:52 2021 -0400 Home & Kibana Overview Page Template Update (elastic#103003) * apply page template comp to kibana overview * apply page template comp to home page * clean up * strip null actions from array * update snapshot and remove outdated import * fix tests and update snapshots * update tests and snapshots * Switch to KibanaPageTemplate; use template=“empty” * update snapshots * make `EuiCard` transparent * updated snapshots * restored data-test-subj="homeApp" * change scope of styles * update snapshots commit c6d04a9 Author: Pete Harverson <peteharverson@users.noreply.github.com> Date: Fri Jun 25 21:57:57 2021 +0100 [ML] Converts management app jobs list pages to new layout (elastic#103117) * [ML] Converts management app jobs list pages to new layout * i[ML] Fix translations * [ML] Set acccessDenied default state back to false * [ML] Remove headers for error states and text updates following review Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> commit 6726537 Author: Pierre Gayvallet <pierre.gayvallet@gmail.com> Date: Fri Jun 25 20:41:37 2021 +0200 Allow additive csp configuration (elastic#102059) * add additive csp configuration * add unit tests for new class * fix types * adapt test utils * fix tests * more unit tests on config * generated doc * review comments * update ascii doc * update ascii doc links * automatically add single quotes for keywords * add missing csp directives * add more tests * add additional settings to asciidoc * add null-check * revert test config props * fix usage collection usage * some review comments * last review comments * add kibana-docker variables * try to fix doc reference * try to fix doc reference again * fix tests commit d16a464 Author: Wylie Conlon <william.conlon@elastic.co> Date: Fri Jun 25 13:13:57 2021 -0400 [Lens] Document common formulas in product and add formula tutorial (elastic#103154) * [Lens] Document common formulas in product and add formula tutorial * Make common formulas appear in sidebar and format consistently Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> commit dfc70bd Author: Marco Liberati <dej611@users.noreply.github.com> Date: Fri Jun 25 14:59:36 2021 +0200 [Lens] Enable actions on Lens Embeddable (elastic#102038) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> commit 922d7cc Author: Patryk Kopyciński <patryk.kopycinski@elastic.co> Date: Fri Jun 25 11:03:46 2021 +0300 [Osquery] Return proper indices permissions for osquery_manager package (elastic#103363) commit baf2de5 Author: Vadim Dalecky <streamich@gmail.com> Date: Fri Jun 25 07:58:03 2021 +0200 Dashboard locator (elastic#102854) * Add dashboard locator * feat: 🎸 expose dashboard locator from dashboard plugin * Use dashboard locator in dashboard drilldown * Add tests for dashboard locator * Fix dashboard drilldown tests after refactor * Deprecate dashboard URL generator * Fix TypeScript errors in exmaple plugin * Use correct type for dashboard locator * refactor: 💡 change "route" attribute to "path" * chore: 🤖 remove unused bundle Co-authored-by: Vadim Kibana <vadimkibana@gmail.com> Co-authored-by: Vadim Kibana <82822460+vadimkibana@users.noreply.github.com> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> commit bc6ee27 Author: Vadim Dalecky <streamich@gmail.com> Date: Fri Jun 25 07:55:06 2021 +0200 Maps locators (elastic#102810) * feat: 🎸 implement maps locator * feat: 🎸 add tile map locator * feat: 🎸 add region map locator * feat: 🎸 register maps locators * refactor: 💡 remove usage of mpas url gen, replace by locator * chore: 🤖 remove url generators * refactor: 💡 use locators in maps deprecation messages * chore: 🤖 remove maps url generators * refactor: 💡 use new property name * feat: 🎸 use constant Co-authored-by: Vadim Kibana <vadimkibana@gmail.com> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> commit bc8ba83 Author: Andrew Kroh <andrew.kroh@elastic.co> Date: Fri Jun 25 00:22:29 2021 -0400 [Fleet] Add support for constant_keyword "value" in package field definitions (elastic#103000) This enables Fleet to accept package field definitions that declare a constant "value" for `constant_keyword` fields. Fleet will generate an index template for the constant_keyword field that contains the `value` attribute. Relates: elastic/package-spec#194 Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> commit 4b20ff3 Author: Aaron Caldwell <aaron.caldwell@elastic.co> Date: Thu Jun 24 20:25:26 2021 -0600 [Maps] Add capability to delete features from layer & index (elastic#103145) commit 41b015a Author: Kevin Logan <56395104+kevinlog@users.noreply.github.com> Date: Thu Jun 24 20:23:13 2021 -0400 [Security Solution] Correct linux OS lookup for Endpoint Exceptions (elastic#103038) commit 3838bfd Author: Scotty Bollinger <scotty.bollinger@elastic.co> Date: Thu Jun 24 18:53:03 2021 -0500 [Enterprise Search] Add notices for deactivated users and SMTP callout (elastic#103285) * Port elastic#3904 to Kibana elastic/ent-search#3904 * DRY out logic interfaces Should have done this long ago * Port elastic#3920 to Kibana elastic/ent-search#3920 * Lint fixes * Remove error state from form We already did this for the users flyout. Basically changes the dirty state of the form from an error state to just showing “Required”. i18n had not been translated yet for `ATTRIBUTE_VALUE_ERROR` * Add loading states * Remove manual disabling of button Co-authored-by: Constance <constancecchen@users.noreply.github.com> * Remove manual disabling of other button * Lint fixes Co-authored-by: Constance <constancecchen@users.noreply.github.com> commit 2056845 Author: Clint Andrew Hall <clint.hall@elastic.co> Date: Thu Jun 24 18:05:11 2021 -0500 [canvas] Reduce bundle size by combining SCSS imports (elastic#102822) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> commit 803d0fa Author: Constance <constancecchen@users.noreply.github.com> Date: Thu Jun 24 16:02:48 2021 -0700 [Enterprise Search] Final KibanaPageTemplate cleanup (elastic#103355) * [AS] Delete AppSearchNav and EngineNav * [WS] Delete WorkplaceSearchNav * [Shared] Delete custom Layout & SideNav components commit bd2215f Author: Luke Elmers <luke.elmers@elastic.co> Date: Thu Jun 24 16:46:19 2021 -0600 [docs][migrations v2] Update SO migration docs to include removal of index write block when handling corrupt SOs. (elastic#103014) commit c1ced88 Author: Ross Wolf <31489089+rw-access@users.noreply.github.com> Date: Thu Jun 24 15:31:25 2021 -0600 [Detections] Adds automatic updating for Prebuilt Security Detection Rules package (elastic#101846) * Automatically install and update the security_detection_engine package * Remove security_detection_engine from required Fleet packages * Update fleet package-registry image * Add sha256: to the distribution package * Use distribution from https://beats-ci.elastic.co/job/Ingest-manager/job/release-distribution/152 * Change fleet required packag * Fix bad merge * Update rules to 0.13.1 package * Fix NOTICE.txt commit 45b6601 Author: Jonathan Budzenski <jon@budzenski.me> Date: Thu Jun 24 16:19:01 2021 -0500 skip suite failing es promotion. elastic#103364 commit b12095b Author: Chris Cowan <chris@chriscowan.us> Date: Thu Jun 24 14:13:15 2021 -0700 [Metrics UI] Prevent saved views from trampling URL state (elastic#103146) * [Metrics UI] Prevent saved views from trampling URL state * Adding space back in commit d5f68ee Author: Wylie Conlon <william.conlon@elastic.co> Date: Thu Jun 24 16:46:50 2021 -0400 [Lens] Fix formula formatting in Metric visualization type (elastic#103167) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> commit 60086a9 Author: Constance <constancecchen@users.noreply.github.com> Date: Thu Jun 24 13:30:02 2021 -0700 Fix Engine Overview not properly stretching to full page height (elastic#103337) - Caused by the wrapping <div> around the child views - removing that div and moving the `data-test-subj` hooks to the individual views fixes the issue commit e1ef2ea Author: Aaron Caldwell <aaron.caldwell@elastic.co> Date: Thu Jun 24 14:18:44 2021 -0600 [Maps] Disable edit features if editing already enabled for layer (elastic#103300) commit c0122f7 Author: Aaron Caldwell <aaron.caldwell@elastic.co> Date: Thu Jun 24 14:17:09 2021 -0600 [Maps] Disable draw mode on layer remove (elastic#103188) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> commit cebf16f Author: Candace Park <56409205+parkiino@users.noreply.github.com> Date: Thu Jun 24 16:11:16 2021 -0400 [Security Solution][Endpoint][Host Isolation] Remove agent status for non endpoint alerts (elastic#102976) commit 0857e62 Author: Scotty Bollinger <scotty.bollinger@elastic.co> Date: Thu Jun 24 14:59:10 2021 -0500 [Workplace Search] Remove `isFederatedAuth` checks to expose user features (elastic#103278) * Remove isFederated from main app and routes * Expose all overview cards that were hidden for federated auth * Expose all user features that were hidden for groups * Remove remaining isFederatedAuth references * Lint fixes * Add modified test back for Workplace Search * Remove extraCell Co-authored-by: Constance <constancecchen@users.noreply.github.com> * Remove brackets Co-authored-by: Constance <constancecchen@users.noreply.github.com> * Update test name Co-authored-by: Constance <constancecchen@users.noreply.github.com> Co-authored-by: Constance <constancecchen@users.noreply.github.com> commit fb3e8f4 Author: Constance <constancecchen@users.noreply.github.com> Date: Thu Jun 24 12:43:26 2021 -0700 [Enterprise Search] Product 404 polish pass (elastic#103198) * Refactor NotFound component - shared NotFound becomes NotFoundPrompt - returns only an EuiEmptyPrompt, and individual products/plugins are in charge of their own layout, rather than NotFound doing a bunch of arduous switch handling (also closer to how errorConnecting is a component set per-plugin) - This is both due to the recent page template refactor and the fact that WS has extra complex logic of needing to switch between its kibana layout and personal dashboard layout - logos are still hosted in shared/ since they need extra custom CSS to work correctly sizing wise and in dark mode. I renamed its folder from `assets`->`logos` for extra clarity * [AS] Update current AS routers using NotFound + update EngineRouter to use NotFound * [WS] Update app router - Handle errorConnecting at the topmost level, instead of in WorkplaceSearchConfigured (to simplify various logic/expectations & match App Search) - Simplify isOrganization check to use `useRouteMatch` instead of a regex - Use new NotFound component - Add NotFound component for the personal dashboard router * [WS] Improve Source 404 UX - Add NotFound to SourceRouter + add breadcrumbs for organization views - When an actual source ID 404s, fix blanket redirect to a dashboard aware redirect - personal dashboard 404s should send the user back to personal sources, not organization sources + add a flash message error (similar to how App Search behaves for engine 404s) + harden error status checks (gracefully allow for non-http errors to fall back flashAPIErrors * [WS] Improve Settings 404 UX - This was the only remaining WS route I found that either did not have a 404 or a fallback to some overview page, so I tweaked the redirect order for a graceful redirect (vs a blank page) * Fix settings router test * Move away from custom product logos to OOTB Enterprise Search logo Keeping it simple, etc. RIP in peace fancy logos * [PR feedback] toContain over stringContaining commit 8011451 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Thu Jun 24 15:38:18 2021 -0400 fixing unit tests commit 9ba1ead Author: Kerry Gallagher <471693+Kerry350@users.noreply.github.com> Date: Thu Jun 24 20:12:52 2021 +0100 [Logs UI] Log threshold rule performance improvements (elastic#102650) * Add optimisations for executor / chart previews Co-authored-by: Felix Stürmer <weltenwort@users.noreply.github.com> commit 67d4c31 Author: Kuldeep M <crudetoaster@gmail.com> Date: Thu Jun 24 20:10:22 2021 +0100 [Workplace Search] source connection panel content vertical alignment (elastic#103225) * fix 1786 source connection panel vertical alignment * Update x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/configured_sources_list.tsx Co-authored-by: Constance <constancecchen@users.noreply.github.com> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Constance <constancecchen@users.noreply.github.com> commit fbcf405 Author: Josh Dover <1813008+joshdover@users.noreply.github.com> Date: Thu Jun 24 20:47:38 2021 +0200 Add telemetry for Elastic Cloud (elastic#102390) commit fb7b596 Author: Kyle Pollich <kyle.pollich@elastic.co> Date: Thu Jun 24 14:29:56 2021 -0400 Fix missing setting modal in integrations app (elastic#103317) commit 23c8d18 Author: Spencer <email@spalger.com> Date: Thu Jun 24 10:59:49 2021 -0700 [ui-shared-deps] reuse react-beautiful-dnd from eui (elastic#102834) Co-authored-by: spalger <spalger@users.noreply.github.com> commit ebf9e7d Author: cauemarcondes <caue.marcondes@elastic.co> Date: Thu Jun 24 13:32:37 2021 -0400 removing commented code commit bf6c53b Author: Tim Roes <tim.roes@elastic.co> Date: Thu Jun 24 19:31:24 2021 +0200 Improved Visualize button in field popover (elastic#103099) * Improve field popover * Slightly improve type safteyness * Add unit tests for visualize trigger utils * Remove unused div Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> commit cb93335 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Thu Jun 24 13:30:59 2021 -0400 refactoring commit 5abac25 Author: Marco Liberati <dej611@users.noreply.github.com> Date: Thu Jun 24 19:19:20 2021 +0200 [Lens] Update formula icons (elastic#103287) * 💄 Updated formula reference icon * 💄 Replace wordwrap icons commit 5af69ed Author: Dmitry Shevchenko <dmshevch@gmail.com> Date: Thu Jun 24 19:17:09 2021 +0200 Fix "Deleted rule" badge is not displayed if 'Rule Name' contains more than 55 words (elastic#103164) commit eb8e9d7 Author: John Schulz <john.schulz@elastic.co> Date: Thu Jun 24 12:56:48 2021 -0400 [Fleet] Remove duplication between two files elastic#103282 ## Summary `public/applications/integrations/constants.tsx` and `public/applications/integrations/sections/epm/constants.tsx` are identical except for this line in `public/applications/integrations/constants.tsx` ```ts export * from '../../constants'; ``` This PR removes all the duplication from the "upper" file (`public/applications/integrations/constants.tsx`) and leaves the other code "down" in `/sections/epm/` closer to where it's used. Initially, I deleted `public/applications/integrations/constants.tsx` entirely but several files do `import` the constants it exports, so I left it. commit bfb9805 Author: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com> Date: Thu Jun 24 12:53:56 2021 -0400 [DOCS] Security Overview (elastic#103151) * updating overview topic for Kibana * formatting fixes * small formatting tweaks * small formatting tweaks * Update index.asciidoc Updating index file; removing siem-UI and machine learning topics from the TOC. * [DOCS] Change part to chapter * Update index.asciidoc * Adding <titleabbrev> attribute Co-authored-by: lcawl <lcawley@elastic.co> commit 9ead1fc Author: Pete Harverson <peteharverson@users.noreply.github.com> Date: Thu Jun 24 17:49:56 2021 +0100 [ML] Add description and owner to kibana.json for ML owned plugins (elastic#103254) commit 1198454 Author: Pete Harverson <peteharverson@users.noreply.github.com> Date: Thu Jun 24 17:44:13 2021 +0100 [ML] Fixes data frame analytics models list pipelines tab (elastic#103235) commit 5e89873 Author: Bryan Clement <bclement01@gmail.com> Date: Thu Jun 24 09:31:57 2021 -0700 [Asset management] Osquery app bug squashing (elastic#102406) * only display healthy agents to query * updated toasts to clear on update * null checking aggBuckets * properly display expired actions * clear the error toasts on success * review comments Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> commit dd20b8a Author: Aleh Zasypkin <aleh.zasypkin@gmail.com> Date: Thu Jun 24 18:22:14 2021 +0200 Avoid using deprecated camelCase parameters for SAML APIs. (elastic#103091) commit 7e32f93 Author: ymao1 <ying.mao@elastic.co> Date: Thu Jun 24 12:20:16 2021 -0400 [Alerting] Using new es client in alerting functional tests (elastic#102349) * Switching to new es client in alerting tests * Fixing types * Updating functional test * Updating functional test * Updating functional test * Fixing error handling * Fixing types * Fixing error handling * Fixing functional tests * Fixing functional tests Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> commit aefdb9c Author: Nathan Reese <reese.nathan@gmail.com> Date: Thu Jun 24 09:54:38 2021 -0600 [Maps] timeslider play button (elastic#103147) * [Maps] timeslider play button * cancel subscription on unmount * change playback speed to 1750 Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> commit f2ebcad Author: Yulia Čech <6585477+yuliacech@users.noreply.github.com> Date: Thu Jun 24 17:51:05 2021 +0200 Refactored helpers file into separate domain files (elastic#102383) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> commit 686ac90 Author: Dmitry Tomashevich <39378793+Dmitriynj@users.noreply.github.com> Date: Thu Jun 24 18:27:29 2021 +0300 [Discover] Move focus on chart toggle in Discover (elastic#103119) * [Discover] move focus on show chart * [Discover] set actual moveFocus flag commit 44613d6 Merge: 03750ff d3295d3 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Thu Jun 24 11:15:25 2021 -0400 Merge branch 'apm-tutorial-storybook' into apm-tutorial-token commit dd072c3 Author: Chris Roberson <chrisronline@gmail.com> Date: Thu Jun 24 11:09:47 2021 -0400 [Task Manager] Add config switch around logging at different levels based on the state (elastic#102804) * Gate behind a config with warning message that helps users enable * Update more files * Fix docs formatting * Preserve existing functionality * Add in task type to the message * Show multiple alert types that are over the threshold Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> commit 03750ff Merge: 05eb303 5a76c84 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Thu Jun 24 11:09:42 2021 -0400 Merge branch 'master' of github.com:elastic/kibana into apm-tutorial-token commit d3295d3 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Wed Jun 23 17:13:56 2021 -0400 adding storybook commit be0ef2e Merge: 7a5ee52 05eb303 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Wed Jun 23 16:05:42 2021 -0400 Merge branch 'apm-tutorial-token' of github.com:cauemarcondes/kibana into apm-tutorial-storybook commit 7a5ee52 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Wed Jun 23 16:05:29 2021 -0400 adding storybook commit 05eb303 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Wed Jun 23 11:11:59 2021 -0400 updating apm int version commit 7baf6a2 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Wed Jun 23 11:11:03 2021 -0400 moving files commit d22b841 Merge: 8582eb8 157d7a4 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Wed Jun 23 09:55:41 2021 -0400 Merge branch 'apm-fleet-tutorial' of github.com:cauemarcondes/kibana into apm-tutorial-token commit 157d7a4 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Wed Jun 23 09:55:05 2021 -0400 moving tutorial to a common directory commit 8582eb8 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Tue Jun 22 16:28:40 2021 -0400 renaming commit 8f38c6e Merge: 41081da 98f89a1 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Tue Jun 22 16:27:03 2021 -0400 Merge branch 'apm-fleet-tutorial' of github.com:cauemarcondes/kibana into apm-tutorial-token commit 98f89a1 Merge: 75e6e28 dec77cf Author: cauemarcondes <caue.marcondes@elastic.co> Date: Tue Jun 22 16:26:43 2021 -0400 Merge branch 'master' of github.com:elastic/kibana into apm-fleet-tutorial commit 41081da Merge: 4c0d2db 75e6e28 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Tue Jun 22 16:24:59 2021 -0400 Merge branch 'apm-fleet-tutorial' of github.com:cauemarcondes/kibana into apm-tutorial-token commit 4c0d2db Author: cauemarcondes <caue.marcondes@elastic.co> Date: Tue Jun 22 16:23:31 2021 -0400 adding help text commit 75e6e28 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Tue Jun 22 16:17:05 2021 -0400 fixing TS issue commit 4ef392e Author: cauemarcondes <caue.marcondes@elastic.co> Date: Tue Jun 22 15:57:58 2021 -0400 fixing TS issue commit 9dc6281 Merge: 915754f 2087a9d Author: cauemarcondes <caue.marcondes@elastic.co> Date: Tue Jun 22 14:50:08 2021 -0400 Merge branch 'apm-fleet-tutorial' of github.com:cauemarcondes/kibana into apm-tutorial-token commit 915754f Author: cauemarcondes <caue.marcondes@elastic.co> Date: Tue Jun 22 14:44:00 2021 -0400 adding unit test commit 585dcb9 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Tue Jun 22 13:17:43 2021 -0400 refactoring eui component commit 2087a9d Author: cauemarcondes <caue.marcondes@elastic.co> Date: Mon Jun 21 16:38:55 2021 -0400 addressing PR comments commit 00d88ff Author: cauemarcondes <caue.marcondes@elastic.co> Date: Mon Jun 21 15:58:06 2021 -0400 refactoring commit efb9a7f Merge: 5033edb 496f713 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Mon Jun 21 11:23:09 2021 -0400 Merge branch 'apm-fleet-tutorial' of github.com:cauemarcondes/kibana into apm-tutorial-token commit 496f713 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Mon Jun 21 11:21:44 2021 -0400 adding unit test commit e9a4463 Merge: 5dddd48 e97cfad Author: cauemarcondes <caue.marcondes@elastic.co> Date: Mon Jun 21 10:26:35 2021 -0400 Merge branch 'master' of github.com:elastic/kibana into apm-fleet-tutorial commit 5dddd48 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Mon Jun 21 10:26:14 2021 -0400 adding unit test commit 5033edb Author: cauemarcondes <caue.marcondes@elastic.co> Date: Fri Jun 18 16:02:23 2021 -0400 adjusting size commit 798503a Author: cauemarcondes <caue.marcondes@elastic.co> Date: Fri Jun 18 15:35:24 2021 -0400 refactoring commit 0225a8c Author: cauemarcondes <caue.marcondes@elastic.co> Date: Fri Jun 18 11:36:19 2021 -0400 adding environment credencials commit f5c3464 Merge: 7e441d2 036c157 Author: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Date: Wed Jun 16 10:19:17 2021 -0400 Merge branch 'master' into apm-fleet-tutorial commit 7e441d2 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Tue Jun 15 10:38:55 2021 -0400 fixing issues commit c051953 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Tue Jun 15 09:59:00 2021 -0400 adding i18n commit 82e61eb Author: cauemarcondes <caue.marcondes@elastic.co> Date: Mon Jun 14 14:56:16 2021 -0400 fixing tests commit 1746467 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Mon Jun 14 12:35:39 2021 -0400 addressing PR comments commit 610aebb Merge: ba03e53 0993a1c Author: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Date: Mon Jun 14 09:30:43 2021 -0400 Merge branch 'master' into apm-fleet-tutorial commit ba03e53 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Thu Jun 10 15:33:39 2021 -0400 fixing TS issue commit 7dadd85 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Thu Jun 10 15:17:44 2021 -0400 addin custom component registration function commit 35c5672 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Thu Jun 10 11:02:28 2021 -0400 registering status check callback commit 2c4112c Author: cauemarcondes <caue.marcondes@elastic.co> Date: Wed Jun 9 16:36:03 2021 -0400 refactoring commit 831e2c0 Merge: 71a43d8 6b326e8 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Wed Jun 9 16:31:54 2021 -0400 Merge branch 'apm-fleet-tutorial' of github.com:cauemarcondes/kibana into apm-fleet-tutorial commit 71a43d8 Merge: 66b9351 4e0c889 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Wed Jun 9 14:56:24 2021 -0400 Merge branch 'master' of github.com:elastic/kibana into apm-fleet-tutorial commit 6b326e8 Merge: 9990697 3930749 Author: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Date: Mon Jun 7 08:25:16 2021 -0400 Merge branch 'master' into apm-fleet-tutorial commit 9990697 Merge: 66b9351 8f83090 Author: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Date: Fri Jun 4 09:45:49 2021 -0400 Merge branch 'master' into apm-fleet-tutorial commit 66b9351 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Wed Jun 2 14:05:42 2021 -0400 adding fleet information on APM tutorial commit 2f81e72 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Tue Jun 1 14:33:43 2021 -0400 checks apm fleet integration when pushing button commit 0f0f458 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Tue Jun 1 10:44:11 2021 -0400 adding fleet information on APM tutorial commit 2a00cc7 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Mon May 31 15:48:00 2021 -0400 fixing i18n commit e854f34 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Mon May 31 15:41:03 2021 -0400 adding fleet typing commit 23695bc Merge: 07f91b5 af4b8e6 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Mon May 31 15:18:44 2021 -0400 Merge branch 'master' of github.com:elastic/kibana into apm-fleet-tutorial commit 07f91b5 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Mon May 31 15:12:00 2021 -0400 adding fleet information on APM tutorial commit 3f484a7 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Thu May 27 14:51:32 2021 -0400 adding fleet section commit 92d34b1 Merge: e38e390 1ceecd3 Author: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Date: Thu May 27 13:06:08 2021 -0400 Merge branch 'master' into apm-moving-tutorial commit e38e390 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Thu May 27 10:45:58 2021 -0400 fixing i18n commit 7195da0 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Thu May 27 09:29:54 2021 -0400 removing export commit 3afb580 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Wed May 26 14:28:45 2021 -0400 removing tutorial from apm_oss commit 25fec3f Author: cauemarcondes <caue.marcondes@elastic.co> Date: Wed May 26 13:46:46 2021 -0400 using files from apm commit 515c1c9 Author: cauemarcondes <caue.marcondes@elastic.co> Date: Wed May 26 13:16:37 2021 -0400 Register tutorial on APM plugin

pgayvallet added 6 commits June 14, 2021 15:02

add additive csp configuration

80ecded

add unit tests for new class

73890df

fix types

303d60a

adapt test utils

b3d60b2

fix tests

ee9f805

Merge remote-tracking branch 'upstream/master' into kbn-94414-additiv…

c8eccd5

…e-csp

pgayvallet added release_note:skip Skip the PR/issue when compiling release notes Team:Core Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc v7.14.0 labels Jun 14, 2021

pgayvallet added 2 commits June 15, 2021 08:00

Merge remote-tracking branch 'upstream/master' into kbn-94414-additiv…

d531ac0

…e-csp

more unit tests on config

dca375f

pgayvallet commented Jun 15, 2021

View reviewed changes

generated doc

4b45111

pgayvallet marked this pull request as ready for review June 15, 2021 07:06

pgayvallet requested review from a team as code owners June 15, 2021 07:06

joshdover approved these changes Jun 15, 2021

View reviewed changes

legrego requested a review from jportner June 15, 2021 12:42

pgayvallet added 2 commits June 15, 2021 14:57

review comments

ca5616d

Merge remote-tracking branch 'upstream/master' into kbn-94414-additiv…

2188b0e

…e-csp

pgayvallet added release_note:deprecation and removed release_note:skip Skip the PR/issue when compiling release notes labels Jun 15, 2021

update ascii doc

0d3bd2c

jportner reviewed Jun 15, 2021

View reviewed changes

pgayvallet added 2 commits June 16, 2021 07:57

Merge remote-tracking branch 'upstream/master' into kbn-94414-additiv…

400b2d1

…e-csp

update ascii doc links

e1eb1b5

pgayvallet added 2 commits June 23, 2021 08:07

revert test config props

c74ada5

fix usage collection usage

59303f4

pgayvallet commented Jun 23, 2021

View reviewed changes

pgayvallet requested a review from jportner June 23, 2021 08:55

jportner reviewed Jun 23, 2021

View reviewed changes

pgayvallet added 4 commits June 24, 2021 08:07

Merge remote-tracking branch 'upstream/master' into kbn-94414-additiv…

3d7947c

…e-csp

some review comments

3609981

last review comments

966fc55

add kibana-docker variables

04a4f59

pgayvallet requested a review from a team as a code owner June 24, 2021 06:41

pgayvallet added 2 commits June 24, 2021 09:09

try to fix doc reference

e9590d4

try to fix doc reference again

fff64d8

jbudz approved these changes Jun 24, 2021

View reviewed changes

jportner approved these changes Jun 24, 2021

View reviewed changes

src/core/server/csp/config.test.ts Outdated Show resolved Hide resolved

pgayvallet added 2 commits June 25, 2021 14:05

Merge remote-tracking branch 'upstream/master' into kbn-94414-additiv…

46681a3

…e-csp

fix tests

596db0d

pgayvallet merged commit 6726537 into elastic:master Jun 25, 2021

pgayvallet mentioned this pull request Jun 25, 2021

[7.x] Allow additive csp configuration (#102059) #103405

Merged

jportner mentioned this pull request Sep 30, 2021

Remove deprecated Core settings #103915

Closed

TinaHeiligers mentioned this pull request Oct 7, 2021

[8.0] Remove support for configuring csp.rules #114379

Merged

7 tasks

pgayvallet mentioned this pull request Oct 11, 2021

Ability to configure external scripts/snippets to load on every page #113903

Closed

pgayvallet mentioned this pull request Apr 29, 2024

Expose a security header API to plugins #181812

Open

legrego mentioned this pull request Jun 6, 2024

Migrate Permissions Policy configuration #184939

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow additive csp configuration #102059

Allow additive csp configuration #102059

pgayvallet commented Jun 14, 2021 •

edited

Loading

pgayvallet left a comment •

edited

Loading

pgayvallet Jun 15, 2021

pgayvallet Jun 15, 2021

pgayvallet Jun 15, 2021

pgayvallet Jun 15, 2021

pgayvallet Jun 15, 2021

pgayvallet Jun 15, 2021

pgayvallet Jun 15, 2021

pgayvallet Jun 15, 2021

elasticmachine commented Jun 15, 2021

joshdover left a comment

joshdover Jun 15, 2021

joshdover commented Jun 15, 2021

jportner left a comment •

edited

Loading

pgayvallet commented Jun 15, 2021

jportner commented Jun 15, 2021

pgayvallet left a comment

pgayvallet Jun 23, 2021

pgayvallet Jun 23, 2021

pgayvallet Jun 23, 2021

jportner left a comment •

edited

Loading

jbudz left a comment

jportner left a comment

kibanamachine commented Jun 25, 2021

API count

Allow additive csp configuration #102059

Allow additive csp configuration #102059

Conversation

pgayvallet commented Jun 14, 2021 • edited Loading

Summary

Release notes

Checklist

pgayvallet left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Jun 15, 2021

joshdover left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

joshdover commented Jun 15, 2021

jportner left a comment • edited Loading

Choose a reason for hiding this comment

pgayvallet commented Jun 15, 2021

jportner commented Jun 15, 2021

pgayvallet left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jportner left a comment • edited Loading

Choose a reason for hiding this comment

jbudz left a comment

Choose a reason for hiding this comment

jportner left a comment

Choose a reason for hiding this comment

kibanamachine commented Jun 25, 2021

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Public APIs missing exports

API count

History

pgayvallet commented Jun 14, 2021 •

edited

Loading

pgayvallet left a comment •

edited

Loading

jportner left a comment •

edited

Loading

jportner left a comment •

edited

Loading