Update nextUrl validation to incorporate serverBasePath (#2048) (#2050)

[Crispy-fried-chicken]

Here is a vulnerability which is fixed in the main branch and 2.16(fc4f6a2) but is not fixed in the branch of 2.15, maybe it should be backported?

[cwperks]

Hi @Crispy-fried-chicken , there are no plans for a 2.15.1 release. I would be happy to accept this backport, but you will need to manually create a zip of this dashboards plugin to get this change for an instance of OSD running 2.15.0.

FYI There was a follow-up to this PR with a bugfix that should also be included: #2096

[Crispy-fried-chicken]

but you will need to manually create a zip of this dashboards plugin to get this change for an instance of 2.15.0.

@cwperks What does it mean? sorry I‘m not familiar with it, maybe you can tell me how? Besides, I saw here is some unit tests don't pass, can you tell me how to fix it? Thank you!

[cwperks]

@Crispy-fried-chicken It means that to consume this change would require manually creating a zip of this dashboards plugin and installing it manually.

To create a zip of a plugin, checkout the corresponding branch and run yarn build --skip-os-packages. The zip that this command produces will be located in the build directory.

You can then use ./bin/opensearch-dashboards-plugin <remove|install> ... to replace the previous build of the plugin. See the documentation for details on how to replace a dashboards plugin.

[Crispy-fried-chicken]

To create a zip of a plugin, checkout the corresponding branch and run yarn build --skip-os-packages. The zip that this command produces will be located in the build directory.

I run yarn build --skip-os-packages, but here return an error:

node:internal/modules/cjs/loader:1051
  throw err;
  ^

Error: Cannot find module 'C:\Users\scripts\plugin_helpers'
    at Module._resolveFilename (node:internal/modules/cjs/loader:1048:15)
    at Module._load (node:internal/modules/cjs/loader:901:27)
    at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:83:12)
    at node:internal/main/run_main_module:23:47 {
  code: 'MODULE_NOT_FOUND',
  requireStack: []
}

I run yarn add plugin_helpers to add this module but failed, how can I do? Thank you for your patience.

[derek-ho]

To create a zip of a plugin, checkout the corresponding branch and run yarn build --skip-os-packages. The zip that this command produces will be located in the build directory.

I run yarn build --skip-os-packages, but here return an error:

node:internal/modules/cjs/loader:1051
  throw err;
  ^

Error: Cannot find module 'C:\Users\scripts\plugin_helpers'
    at Module._resolveFilename (node:internal/modules/cjs/loader:1048:15)
    at Module._load (node:internal/modules/cjs/loader:901:27)
    at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:83:12)
    at node:internal/main/run_main_module:23:47 {
  code: 'MODULE_NOT_FOUND',
  requireStack: []
}

I run yarn add plugin_helpers to add this module but failed, how can I do? Thank you for your patience.

You need to clone this repo within plugin folder of: https://github.com/opensearch-project/opensearch-dashboards, plugin_helpers is found within OSD repo.

[Crispy-fried-chicken]

I run it, but still failed. the error is :

yarn run v1.22.19
$ yarn plugin-helpers build && node build_tools/rename_zip.js --skip-os-packages
$ node ../../scripts/plugin_helpers build
node:internal/modules/cjs/loader:1051
throw err;
^

Error: Cannot find module 'require-in-the-middle'
Require stack:

• C:\Users\ASUS\Desktop\OpenSearch-Dashboards\src\setup_node_env\harden\child_process.js
• C:\Users\ASUS\Desktop\OpenSearch-Dashboards\src\setup_node_env\harden\index.js
• C:\Users\ASUS\Desktop\OpenSearch-Dashboards\src\setup_node_env\no_transpilation.js
• C:\Users\ASUS\Desktop\OpenSearch-Dashboards\scripts\plugin_helpers.js
  at Module._resolveFilename (node:internal/modules/cjs/loader:1048:15)
  at Module._load (node:internal/modules/cjs/loader:901:27)
  at Module.require (node:internal/modules/cjs/loader:1115:19)
  at require (node:internal/modules/helpers:130:18)
  at Object. (C:\Users\ASUS\Desktop\OpenSearch-Dashboards\src\setup_node_env\harden\child_process.js:31:12)
  at Module._compile (node:internal/modules/cjs/loader:1241:14)
  at Module._extensions..js (node:internal/modules/cjs/loader:1295:10)
  at Module.load (node:internal/modules/cjs/loader:1091:32)
  at Module._load (node:internal/modules/cjs/loader:938:12)
  at Module.require (node:internal/modules/cjs/loader:1115:19) {
  code: 'MODULE_NOT_FOUND',
  requireStack: [
  'C:\Users\ASUS\Desktop\OpenSearch-Dashboards\src\setup_node_env\harden\child_process.js',
  'C:\Users\ASUS\Desktop\OpenSearch-Dashboards\src\setup_node_env\harden\index.js',
  'C:\Users\ASUS\Desktop\OpenSearch-Dashboards\src\setup_node_env\no_transpilation.js',
  'C:\Users\ASUS\Desktop\OpenSearch-Dashboards\scripts\plugin_helpers.js'
  ]
  }

Node.js v20.9.0
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.
error Command failed with exit code 1.

and I run the yarn add require-in-the-middle, it succeed but the error still remain. how can I do? Thank you for your patience.

[derek-ho]

I run it, but still failed. the error is :

yarn run v1.22.19
$ yarn plugin-helpers build && node build_tools/rename_zip.js --skip-os-packages
$ node ../../scripts/plugin_helpers build
node:internal/modules/cjs/loader:1051
throw err;
^
Error: Cannot find module 'require-in-the-middle'
Require stack:

• C:\Users\ASUS\Desktop\OpenSearch-Dashboards\src\setup_node_env\harden\child_process.js
• C:\Users\ASUS\Desktop\OpenSearch-Dashboards\src\setup_node_env\harden\index.js
• C:\Users\ASUS\Desktop\OpenSearch-Dashboards\src\setup_node_env\no_transpilation.js
• C:\Users\ASUS\Desktop\OpenSearch-Dashboards\scripts\plugin_helpers.js
  at Module._resolveFilename (node:internal/modules/cjs/loader:1048:15)
  at Module._load (node:internal/modules/cjs/loader:901:27)
  at Module.require (node:internal/modules/cjs/loader:1115:19)
  at require (node:internal/modules/helpers:130:18)
  at Object. (C:\Users\ASUS\Desktop\OpenSearch-Dashboards\src\setup_node_env\harden\child_process.js:31:12)
  at Module._compile (node:internal/modules/cjs/loader:1241:14)
  at Module._extensions..js (node:internal/modules/cjs/loader:1295:10)
  at Module.load (node:internal/modules/cjs/loader:1091:32)
  at Module._load (node:internal/modules/cjs/loader:938:12)
  at Module.require (node:internal/modules/cjs/loader:1115:19) {
  code: 'MODULE_NOT_FOUND',
  requireStack: [
  'C:\Users\ASUS\Desktop\OpenSearch-Dashboards\src\setup_node_env\harden\child_process.js',
  'C:\Users\ASUS\Desktop\OpenSearch-Dashboards\src\setup_node_env\harden\index.js',
  'C:\Users\ASUS\Desktop\OpenSearch-Dashboards\src\setup_node_env\no_transpilation.js',
  'C:\Users\ASUS\Desktop\OpenSearch-Dashboards\scripts\plugin_helpers.js'
  ]
  }

Node.js v20.9.0
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.
error Command failed with exit code 1.

and I run the yarn add require-in-the-middle, it succeed but the error still remain. how can I do? Thank you for your patience.

Try running yarn osd bootstrap --single-version=loose in the directory of OpenSearch-Dashboards first. This will download all the required deps. Then run yarn build in the security-dashboards-plugin directory, and then it should work.

[Crispy-fried-chicken]

@cwperks @derek-ho Hi, I've already get the zipFile, how can I do to finish this pr?

[derek-ho]

Hi @Crispy-fried-chicken we actually usually do not check in the zip file into the code base. Instead it is built into the distribution using the opensearch-build repo. @cwperks what do you think of this PR?

[cwperks]

@cwperks what do you think of this PR?

See my initial comment. I'm happy to merge this PR when there is passing CI.

I just wanted to convey that there will not be an official OpenSearch 2.15.1 release so consuming the change introduced in this PR will require a user to manually create artifacts and install in their deployments.

[Crispy-fried-chicken]

@cwperks @derek-ho Thank you for your reply, so how can I passing the CI? Thank you for your patience!

[cwperks]

If 2.15.1-SNAPSHOT artifacts don't exist for all components then they need to be generated. It also looks like there are lint issues on the PR which need to be resolves with yarn lint:es --fix.

Again, official 2.15.1 artifacts will never be published so in order for anyone to consume this change requires directly building from the source which you can already do without merging this PR.