[8.12] [EDR Workflows] [Osquery] Change query ID regex pattern (#176507…

…) (#176677)

# Backport

This will backport the following commits from `main` to `8.12`:
- [[EDR Workflows] [Osquery] Change query ID regex pattern
(#176507)](#176507)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Tomasz
Ciecierski","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-02-12T10:56:35Z","message":"[EDR
Workflows] [Osquery] Change query ID regex pattern
(#176507)","sha":"45f554d734f3ee973c3b20a9bbdf24b7bf602f6a","branchLabelMapping":{"^v8.13.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Defend
Workflows","Feature:Osquery","v8.13.0","v8.12.2"],"title":"[EDR
Workflows] [Osquery] Change query ID regex
pattern","number":176507,"url":"https://github.com/elastic/kibana/pull/176507","mergeCommit":{"message":"[EDR
Workflows] [Osquery] Change query ID regex pattern
(#176507)","sha":"45f554d734f3ee973c3b20a9bbdf24b7bf602f6a"}},"sourceBranch":"main","suggestedTargetBranches":["8.12"],"targetPullRequestStates":[{"branch":"main","label":"v8.13.0","branchLabelMappingKey":"^v8.13.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/176507","number":176507,"mergeCommit":{"message":"[EDR
Workflows] [Osquery] Change query ID regex pattern
(#176507)","sha":"45f554d734f3ee973c3b20a9bbdf24b7bf602f6a"}},{"branch":"8.12","label":"v8.12.2","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Tomasz Ciecierski <[email protected]>

x-pack/plugins/osquery/public/packs/queries/validations.test.ts

@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { idHookSchemaValidation } from './validations';
+
+describe('idSchemaValidation', () => {
+  it('returns undefined for valid id', () => {
+    expect(idHookSchemaValidation('valid-id')).toBeUndefined();
+  });
+  it('returns undefined for valid id with numbers', () => {
+    expect(idHookSchemaValidation('123valid_id_123')).toBeUndefined();
+  });
+  it('returns undefined for valid id with underscore _', () => {
+    expect(idHookSchemaValidation('valid_id')).toBeUndefined();
+  });
+  it('returns error message for invalid id with spaces', () => {
+    expect(idHookSchemaValidation('invalid id')).toEqual(
+      'Characters must be alphanumeric, _, or -'
+    );
+  });
+
+  it('returns error message for invalid id with dots', () => {
+    expect(idHookSchemaValidation('invalid.id')).toEqual(
+      'Characters must be alphanumeric, _, or -'
+    );
+  });
+
+  it('returns error message for invalid id with special characters', () => {
+    expect(idHookSchemaValidation('invalid@id')).toEqual(
+      'Characters must be alphanumeric, _, or -'
+    );
+  });
+  it('returns error message for invalid id just numbers', () => {
+    expect(idHookSchemaValidation('1232')).toEqual('Characters must be alphanumeric, _, or -');
+  });
+});

x-pack/plugins/osquery/public/packs/queries/validations.ts

@@ -9,7 +9,9 @@ import { i18n } from '@kbn/i18n';
 import type { FormData, ValidationFunc } from '../../shared_imports';
 
 export const MAX_QUERY_LENGTH = 2000;
-const idPattern = /^[a-zA-Z0-9-_]+$/;
+
+// Has to be a string, can't be just numbers, and cannot contain dot '.'
+const idPattern = /^(?![0-9]+$)[a-zA-Z0-9-_]+$/;
 // still used in Packs
 export const idSchemaValidation: ValidationFunc<FormData, string, string> = ({ value }) => {
   const valueIsValid = idPattern.test(value);