From db3b8c3108abca70ddd64511dfe211ad62834a39 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Wed, 8 Mar 2023 05:13:08 -0500
Subject: [PATCH] [8.7] [Security Solution][Exceptions] - Fix bug allowing user
 to type in custom field option for endpoint exception (#152619) (#152882)

# Backport

This will backport the following commits from `main` to `8.7`:
- [[Security Solution][Exceptions] - Fix bug allowing user to type in
custom field option for endpoint exception
(#152619)](https://github.com/elastic/kibana/pull/152619)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Yara
Tercero","email":"yctercero@users.noreply.github.com"},"sourceCommit":{"committedDate":"2023-03-08T08:32:16Z","message":"[Security
Solution][Exceptions] - Fix bug allowing user to type in custom field
option for endpoint exception (#152619)\n\n## Summary\r\n\r\nAddresses
https://github.com/elastic/kibana/issues/149814","sha":"586f9a14613ce2f22836affe4c1f6c56181e6836","branchLabelMapping":{"^v8.8.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:fix","Team:
SecuritySolution","Feature:Rule Exceptions","Team:Security Solution
Platform","backport:prev-minor","v8.7.0","v8.8.0"],"number":152619,"url":"https://github.com/elastic/kibana/pull/152619","mergeCommit":{"message":"[Security
Solution][Exceptions] - Fix bug allowing user to type in custom field
option for endpoint exception (#152619)\n\n## Summary\r\n\r\nAddresses
https://github.com/elastic/kibana/issues/149814","sha":"586f9a14613ce2f22836affe4c1f6c56181e6836"}},"sourceBranch":"main","suggestedTargetBranches":["8.7"],"targetPullRequestStates":[{"branch":"8.7","label":"v8.7.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.8.0","labelRegex":"^v8.8.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/152619","number":152619,"mergeCommit":{"message":"[Security
Solution][Exceptions] - Fix bug allowing user to type in custom field
option for endpoint exception (#152619)\n\n## Summary\r\n\r\nAddresses
https://github.com/elastic/kibana/issues/149814","sha":"586f9a14613ce2f22836affe4c1f6c56181e6836"}}]}]
BACKPORT-->

Co-authored-by: Yara Tercero <yctercero@users.noreply.github.com>
---
 .../builder/entry_renderer.test.tsx           | 41 +++++++++++++++++++
 .../components/builder/entry_renderer.tsx     |  2 +-
 .../add_edit_endpoint_exception.cy.ts         |  4 +-
 3 files changed, 44 insertions(+), 3 deletions(-)

diff --git a/x-pack/plugins/lists/public/exceptions/components/builder/entry_renderer.test.tsx b/x-pack/plugins/lists/public/exceptions/components/builder/entry_renderer.test.tsx
index 842f1bc2b8db9..f2b820fe71769 100644
--- a/x-pack/plugins/lists/public/exceptions/components/builder/entry_renderer.test.tsx
+++ b/x-pack/plugins/lists/public/exceptions/components/builder/entry_renderer.test.tsx
@@ -122,6 +122,9 @@ describe('BuilderEntryItem', () => {
     expect(wrapper.find('.euiFormHelpText.euiFormRow__text').at(0).text()).toEqual(
       i18n.CUSTOM_COMBOBOX_OPTION_TEXT
     );
+    expect(wrapper.find('[data-test-subj="exceptionBuilderEntryField"]').at(0).props()).toEqual(
+      expect.objectContaining({ acceptsCustomOptions: true })
+    );
   });
 
   test('it does not render custom option text when "allowCustomOptions" is "true" and it is a nested entry', () => {
@@ -154,6 +157,44 @@ describe('BuilderEntryItem', () => {
     );
 
     expect(wrapper.find('.euiFormHelpText.euiFormRow__text').exists()).toBeFalsy();
+    expect(wrapper.find('[data-test-subj="exceptionBuilderEntryField"]').at(0).props()).toEqual(
+      expect.objectContaining({ acceptsCustomOptions: false })
+    );
+  });
+
+  test('it does not render custom option text when "allowCustomOptions" is "false"', () => {
+    wrapper = mount(
+      <BuilderEntryItem
+        autocompleteService={autocompleteStartMock}
+        entry={{
+          correspondingKeywordField: undefined,
+          entryIndex: 0,
+          field: getField('ip'),
+          id: '123',
+          nested: undefined,
+          operator: isOperator,
+          parent: undefined,
+          value: '1234',
+        }}
+        httpService={mockKibanaHttpService}
+        indexPattern={{
+          fields,
+          id: '1234',
+          title: 'logstash-*',
+        }}
+        listType="detection"
+        onChange={jest.fn()}
+        setErrorsExist={jest.fn()}
+        setWarningsExist={jest.fn()}
+        showLabel
+        allowCustomOptions={false}
+      />
+    );
+
+    expect(wrapper.find('.euiFormHelpText.euiFormRow__text').exists()).toBeFalsy();
+    expect(wrapper.find('[data-test-subj="exceptionBuilderEntryField"]').at(0).props()).toEqual(
+      expect.objectContaining({ acceptsCustomOptions: false })
+    );
   });
 
   test('it render mapping issues warning text when field has mapping conflicts', () => {
diff --git a/x-pack/plugins/lists/public/exceptions/components/builder/entry_renderer.tsx b/x-pack/plugins/lists/public/exceptions/components/builder/entry_renderer.tsx
index 4a271bb4e851d..2b75c0c6bbe50 100644
--- a/x-pack/plugins/lists/public/exceptions/components/builder/entry_renderer.tsx
+++ b/x-pack/plugins/lists/public/exceptions/components/builder/entry_renderer.tsx
@@ -205,7 +205,7 @@ export const BuilderEntryItem: React.FC<EntryItemProps> = ({
           isLoading={false}
           isDisabled={isDisabled || indexPattern == null}
           onChange={handleFieldChange}
-          acceptsCustomOptions={entry.nested == null}
+          acceptsCustomOptions={entry.nested == null && allowCustomOptions}
           data-test-subj="exceptionBuilderEntryField"
           showMappingConflicts={true}
         />
diff --git a/x-pack/plugins/security_solution/cypress/e2e/exceptions/rule_details_flow/add_edit_endpoint_exception.cy.ts b/x-pack/plugins/security_solution/cypress/e2e/exceptions/rule_details_flow/add_edit_endpoint_exception.cy.ts
index 48b5a10eb2b61..3476a8f3985e9 100644
--- a/x-pack/plugins/security_solution/cypress/e2e/exceptions/rule_details_flow/add_edit_endpoint_exception.cy.ts
+++ b/x-pack/plugins/security_solution/cypress/e2e/exceptions/rule_details_flow/add_edit_endpoint_exception.cy.ts
@@ -126,7 +126,7 @@ describe('Add endpoint exception from rule details', () => {
   it('edits an endpoint exception item', () => {
     const NEW_ITEM_NAME = 'Exception item-EDITED';
     const ITEM_FIELD = 'event.code';
-    const FIELD_DIFFERENT_FROM_EXISTING_ITEM_FIELD = 'agent.name';
+    const FIELD_DIFFERENT_FROM_EXISTING_ITEM_FIELD = 'agent.type';
 
     // displays existing exception items
     cy.get(EXCEPTION_ITEM_VIEWER_CONTAINER).should('have.length', 1);
@@ -155,7 +155,7 @@ describe('Add endpoint exception from rule details', () => {
 
     // check that updates stuck
     cy.get(EXCEPTION_CARD_ITEM_NAME).should('have.text', NEW_ITEM_NAME);
-    cy.get(EXCEPTION_CARD_ITEM_CONDITIONS).should('have.text', ' agent.nameIS foo');
+    cy.get(EXCEPTION_CARD_ITEM_CONDITIONS).should('have.text', ' agent.typeIS foo');
   });
 
   it('allows user to search for items', () => {