Setting validation for transform APIs

.github/workflows/cypress-workflow.yml

@@ -23,7 +23,7 @@ jobs:
         uses: actions/setup-java@v1
         with:
           # TODO: Parse this from index management plugin
-          java-version: 11
+          java-version: 21
       - name: Checkout index management
         uses: actions/checkout@v2
         with:

server/routes/transforms.ts

@@ -111,12 +111,27 @@ export default function (services: NodeServices, router: IRouter, dataSourceEnab
       path: `${NODE_API._SEARCH_SAMPLE_DATA}/{index}`,
       validate: {
         params: schema.object({
-          index: schema.string(),
+          index: schema.string({
+            validate: (value) => {
+              const invalidCharactersPattern = /[\s,:\"*+\/\\|?#><]/;
+              if (value !== value.toLowerCase() || value.startsWith("_") || value.startsWith("-") || invalidCharactersPattern.test(value)) {
+                return "Invalid index name.";
+              }
+
+              return undefined;
+            },
+          }),
         }),
         query: schema.object({
           from: schema.number(),
           size: schema.number(),
-          ...(dataSourceEnabled ? { dataSourceId: schema.string() } : {}),
+          ...(dataSourceEnabled
+            ? {
+                dataSourceId: schema.string({
+                  maxLength: 100000,
+                }),
+              }
+            : {}),
         }),
         body: schema.any(),
       },
@@ -129,10 +144,77 @@ export default function (services: NodeServices, router: IRouter, dataSourceEnab
       path: `${NODE_API.TRANSFORMS}/_preview`,
       validate: {
         body: schema.object({
-          transform: schema.any(),
+          transform: schema.object({
+            transform_id: schema.string(),
+            schema_version: schema.number(),
+            schedule: schema.object({
+              interval: schema.object({
+                start_time: schema.number(),
+                period: schema.number(),
+                unit: schema.string(),
+              }),
+            }),
+            metadata_id: schema.string(),
+            updated_at: schema.number(),
+            enabled: schema.boolean(),
+            enabled_at: schema.maybe(schema.any()),
+            description: schema.maybe(schema.string()),
+            source_index: schema.string({
+              validate: (value) => {
+                const invalidCharactersPattern = /[\s,:\"*+\/\\|?#><]/;
+                if (
+                  value !== value.toLowerCase() ||
+                  value.startsWith("_") ||
+                  value.startsWith("-") ||
+                  invalidCharactersPattern.test(value)
+                ) {
+                  return "Invalid index name.";
+                }
+
+                return undefined;
+              },
+            }),
+            data_selection_query: schema.object({
+              match_all: schema.object({
+                boost: schema.maybe(schema.number()),
+              }),
+            }),
+            target_index: schema.string({
+              validate: (value) => {
+                const invalidCharactersPattern = /[\s,:\"*+\/\\|?#><]/;
+                if (
+                  value !== value.toLowerCase() ||
+                  value.startsWith("_") ||
+                  value.startsWith("-") ||
+                  invalidCharactersPattern.test(value)
+                ) {
+                  return "Invalid index name.";
+                }
+
+                return undefined;
+              },
+            }),
+            page_size: schema.number(),
+            groups: schema.arrayOf(
+              schema.object({
+                terms: schema.object({
+                  source_field: schema.string(),
+                  target_field: schema.string(),
+                }),
+              })
+            ),
+            aggregations: schema.maybe(schema.any()),
+            continuous: schema.maybe(schema.boolean()),
+          }),
         }),
         query: schema.object({
-          ...(dataSourceEnabled ? { dataSourceId: schema.string() } : {}),
+          ...(dataSourceEnabled
+            ? {
+                dataSourceId: schema.string({
+                  maxLength: 100000,
+                }),
+              }
+            : {}),
         }),
       },
     },

server/services/TransformService.test.ts

@@ -0,0 +1,56 @@
+import { schema } from "@osd/config-schema";
+
+describe("Index Name Validation", () => {
+  const validateSchema = schema.object({
+    indexName: schema.string({
+      validate: (value) => {
+        const invalidCharactersPattern = /[\s,:\"*+\/\\|?#><]/;
+        if (value !== value.toLowerCase() || value.startsWith("_") || value.startsWith("-") || invalidCharactersPattern.test(value)) {
+          return "Invalid index name.";
+        }
+
+        return undefined;
+      },
+    }),
+    dataSourceId: schema.maybe(schema.string()),
+  });
+
+  const validateQuery = (indexName: string) => {
+    try {
+      validateSchema.validate({ indexName });
+      return undefined;
+    } catch (e) {
+      return e.message;
+    }
+  };
+
+  it("should fail validation for index names with uppercase letters", () => {
+    const errorMessage = validateQuery("IndexNameWithUppercase");
+    expect(errorMessage).toBe("[indexName]: Invalid index name.");
+  });
+
+  it("should fail validation for index names starting with an underscore", () => {
+    const errorMessage = validateQuery("_indexname");
+    expect(errorMessage).toBe("[indexName]: Invalid index name.");
+  });
+
+  it("should fail validation for index names starting with a hyphen", () => {
+    const errorMessage = validateQuery("-indexname");
+    expect(errorMessage).toBe("[indexName]: Invalid index name.");
+  });
+
+  it("should fail validation for index names containing invalid characters", () => {
+    const errorMessage = validateQuery("********************************");
+    expect(errorMessage).toBe("[indexName]: Invalid index name.");
+  });
+
+  it("should pass validation for valid index names", () => {
+    const errorMessage = validateQuery("valid_index-name123");
+    expect(errorMessage).toBeUndefined();
+  });
+
+  it("should fail validation for index names containing spaces", () => {
+    const errorMessage = validateQuery("invalid index");
+    expect(errorMessage).toBe("[indexName]: Invalid index name.");
+  });
+});

server/services/TransformService.ts

@@ -334,7 +334,7 @@ export default class TransformService extends MDSEnabledClientService {
         },
       });
     } catch (err) {
-      if (err.statusCode === 404 && err.body.error.type === "index_not_found_exception") {
+      if (err.statusCode === 404 && err.body?.error?.type === "index_not_found_exception") {
         return response.custom({
           statusCode: 200,
           body: {