[alerts][actions] malformed JSON in webhook body param throws JSON error

[pmuellr]

Kibana 7.9.3

If you create a webhook in an any type of alert, whose body parameter is the following string, you can save the alert, but when trying to edit it again, a JSON error will be thrown and the display will end up being cleared.

{
    "text": "{{context.matchingDocuments}} events
{{context.conditions}}\n\n{{#toJson}}context{{/toJson}}"
}

Technically, JSON where there's a literal \n in a property, like above, can cause issues, typically when sending the final rendered JSON to a webhook service. Eg, see issue #79371

In this case though, we're seeing an issue when we try to edit the alert again, and the webhook body param editor is hitting a problem.

From the CDT console, the JSON.parse() that's throwing the error is the one in this snippet of code:

kibana/src/plugins/es_ui_shared/__packages_do_not_import__/xjson/json_xjson_translation_tools/index.ts

Lines 70 to 74 in b1aa93f

	if (!skip && candidate.match(/\\./)) {
	result += `"""${JSON.parse(candidate)}"""`;
	} else {
	result += candidate;
	}

This is the code which "triple double quotes" strings like we do for Kibana Dev Console, but I don't think we want that behavior for the JSON we're editing in alerts/actions.

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

[pmuellr]

Playing with this a bit more, when I change the body to remove the embedded newline, I have no issues saving and re-editing the alert:

{
    "text": "{{context.matchingDocuments}} events {{context.conditions}}\n\n{{#toJson}}context{{/toJson}}"
}

However, the alert does get displayed as a "triple double quoted" string in Kibana:

{
    "text": """{{context.matchingDocuments}} events {{context.conditions}}

{{#toJson}}context{{/toJson}}"""
}

I'm not a fan of this, since "triple double quoted" strings aren't a standard of any kind, and so it means I can't simply cut&paste a JSON body like this somewhere else to use with other tools (ie, while developing the alert).

As near as I can tell, the conversion from triple/double to standard JSON is taking place when the alert is saved, as I can see the following in the alert's JSON when I curl it from the console:

"params": {
    "body": "{\n    \"text\": \"{{context.matchingDocuments}} events {{context.conditions}}\\n\\n{{#toJson}}context{{/toJson}}\"\n}"
},

[mikecote]

Moving from 7.12 - Candidates to 7.x - Candidates.

[mikecote]

Moving from 7.x - Candidates to 7.13 after the latest 7.x planning session. If we get time, we will try to implement something simple for this.