From 9f7e2cd17460c44fee023af1989cd5072db5cc13 Mon Sep 17 00:00:00 2001
From: Ryland Herrick <ryalnd@gmail.com>
Date: Fri, 3 Apr 2020 14:09:15 -0500
Subject: [PATCH] Ensure rule message do not span multiple lines (#62391)
 (#62480)

Because these messages are used for logging, we should ensure they do
not span multiple lines and confuse log parsers. Since the frontend does
not currently display these newlines, anyway, there is no impact to the
UI.
---
 .../signals/rule_messages.test.ts             | 20 +++++++++----------
 .../detection_engine/signals/rule_messages.ts |  2 +-
 .../signals/signal_rule_alert_type.ts         |  2 +-
 3 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/rule_messages.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/rule_messages.test.ts
index 8e4b5ce3c9924..bdbb6ff7d1052 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/rule_messages.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/rule_messages.test.ts
@@ -28,25 +28,23 @@ describe('buildRuleMessageFactory', () => {
     expect(message).toEqual(expect.stringContaining('signals index: "index"'));
   });
 
-  it('joins message parts with newlines', () => {
+  it('joins message parts with spaces', () => {
     const buildMessage = buildRuleMessageFactory(factoryParams);
 
     const message = buildMessage('my message');
-    const messageParts = message.split('\n');
-    expect(messageParts).toContain('my message');
-    expect(messageParts).toContain('name: "name"');
-    expect(messageParts).toContain('id: "id"');
-    expect(messageParts).toContain('rule id: "ruleId"');
-    expect(messageParts).toContain('signals index: "index"');
+    expect(message).toEqual(expect.stringContaining('my message '));
+    expect(message).toEqual(expect.stringContaining(' name: "name" '));
+    expect(message).toEqual(expect.stringContaining(' id: "id" '));
+    expect(message).toEqual(expect.stringContaining(' rule id: "ruleId" '));
+    expect(message).toEqual(expect.stringContaining(' signals index: "index"'));
   });
 
-  it('joins multiple arguments with newlines', () => {
+  it('joins multiple arguments with spaces', () => {
     const buildMessage = buildRuleMessageFactory(factoryParams);
 
     const message = buildMessage('my message', 'here is more');
-    const messageParts = message.split('\n');
-    expect(messageParts).toContain('my message');
-    expect(messageParts).toContain('here is more');
+    expect(message).toEqual(expect.stringContaining('my message '));
+    expect(message).toEqual(expect.stringContaining(' here is more'));
   });
 
   it('defaults the rule ID if not provided ', () => {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/rule_messages.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/rule_messages.ts
index d5f9d332bbcdd..cc97a1f8a9f0b 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/rule_messages.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/rule_messages.ts
@@ -24,4 +24,4 @@ export const buildRuleMessageFactory = ({
     `id: "${id}"`,
     `rule id: "${ruleId ?? '(unknown rule id)'}"`,
     `signals index: "${index}"`,
-  ].join('\n');
+  ].join(' ');
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts
index 91905722fbca3..27074be1b5cf4 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts
@@ -126,7 +126,7 @@ export const signalRulesAlertType = ({
                 'Machine learning rule is missing job id and/or anomaly threshold:',
                 `job id: "${machineLearningJobId}"`,
                 `anomaly threshold: "${anomalyThreshold}"`,
-              ].join('\n')
+              ].join(' ')
             );
           }