[User profiles] Strict user profile setting keys by SiddharthMantri · Pull Request #241213 · elastic/kibana

SiddharthMantri · 2025-10-29T23:33:30Z

Summary

Adds strict schema validation to the user profile update API endpoint (/internal/security/user_profile/_data) to restrict the request body to just allowed fields.

The PR also introduces some reasonable defaults for string length for colors and initials.

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Unit or functional tests were updated or added to match the most common scenarios
Flaky Test Runner was used on any tests changed
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines

elasticmachine · 2025-11-07T12:44:30Z

Pinging @elastic/kibana-security (Team:Security)

SiddharthMantri · 2025-11-07T12:44:36Z

@elasticmachine merge upstream

SiddharthMantri · 2025-11-07T12:55:15Z

+      // expect(() => bodySchema.validate(null)).toThrowErrorMatchingInlineSnapshot(
+      //   `"expected a plain object value, but found [null] instead."`
+      // );
+      // expect(() => bodySchema.validate(undefined)).toThrowErrorMatchingInlineSnapshot(
+      //   `"expected value of type [object] but got [undefined]"`
+      // );


Commenting these out as for some reason null and undefined are now accepted and the endpoint schema validation does not throw.

Should we remove these or uncomment?

Also how the route is supposed to react to such requests?

SiddharthMantri · 2025-11-07T12:55:51Z

+      solutionNavOptOut: schema.maybe(schema.boolean()),
+    })
+  ),
+});


Related to https://github.com/elastic/kibana/pull/241213/files#r2503396102

We could add special validation logic here to disallow falsy values.

SiddharthMantri · 2025-11-11T09:02:24Z

@elasticmachine merge upstream

SiddharthMantri · 2025-11-13T18:57:32Z

+    schema.object({
+      initials: schema.nullable(schema.string({ maxLength: MAX_STRING_FIELD_LENGTH })),
+      color: schema.nullable(schema.string({ maxLength: MAX_STRING_FIELD_LENGTH })),
+      imageUrl: schema.nullable(schema.string()),


I've added some defaults for maxLength for these fields.

@azasypkin (tagging you since i saw you assigned to the review 😅) - I'm not sure how to approach restricting imageUrl length.

SiddharthMantri · 2025-11-14T14:21:34Z

@elasticmachine merge upstream

azasypkin · 2025-12-02T12:20:40Z

ACK: I'll review PR today

azasypkin

LGTM, thanks! Just one question/suggestion.

Also, do we need to update this interface as well

kibana/src/platform/packages/shared/kbn-user-profile-components/src/types.ts

Lines 37 to 41 in df17f22

    
           export interface UserSettingsData { 
        
             darkMode?: DarkModeValue; 
        
             contrastMode?: ContrastModeValue; 
        
             solutionNavOptOut?: boolean; 
        
           }

?

azasypkin · 2025-12-02T12:44:49Z

  'solutionNavigationTour:completed', // TODO: remove with https://github.com/elastic/kibana/issues/239313
 ];

+const MAX_STRING_FIELD_LENGTH = 1024;


question/suggestion: Is there any particular reason or use case why we want to support 1024 characters for initials and color instead of, let's say, 100? We can technically go even lower and align with the limits in UI, but I don't have a strong opinion.

If we have a user that has anything in the user profile that's larger than these limits, nothing would break except they'll have to obey the new limits if they decide to update the data, right?

If we have a user that has anything in the user profile that's larger than these limits, nothing would break except they'll have to obey the new limits if they decide to update the data, right?

That's right. It shouldn't affect any existing data since it's just validation on save.

No particular reason for 1024. Matching the UI limits fromm the form field works for me too.

azasypkin · 2025-12-02T13:02:47Z

+  avatar: schema.maybe(
+    schema.object({
+      initials: schema.nullable(schema.string({ maxLength: MAX_STRING_FIELD_LENGTH })),
+      color: schema.nullable(schema.string({ maxLength: MAX_STRING_FIELD_LENGTH })),


note: not really related to this PR as it was like that before, just observation, it looks like we're too aggressive in enforcing a valid avatar color to a degree that one cannot even access their profile to fix the issue (just bypassed UI restriction via dev tools and saved invalid color) 🤦

Interesting, i hadn't come across this. I'll create an issue for us to look into.

Issue created: #245085

SiddharthMantri · 2025-12-02T15:06:58Z

@elasticmachine merge upstream

SiddharthMantri · 2025-12-03T13:16:10Z

@elasticmachine merge upstream

elasticmachine · 2025-12-03T15:12:11Z

💚 Build Succeeded

Buildkite Build
Commit: 44c1ead

Metrics [docs]

✅ unchanged

History

💔 Build #367731 failed ba6c078
💚 Build #365770 succeeded 1f76e37
💚 Build #361406 succeeded 0f4fe06
💛 Build #361166 was flaky 25457b8
💛 Build #360071 was flaky 50558a2

kibanamachine · 2025-12-04T15:34:25Z

Starting backport for target branches: 8.19, 9.1, 9.2

https://github.com/elastic/kibana/actions/runs/19934479447

## Summary Adds strict schema validation to the user profile update API endpoint (/internal/security/user_profile/_data) to restrict the request body to just allowed fields. The PR also introduces some reasonable defaults for string length for colors and initials. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> (cherry picked from commit 90fdc5f)

kibanamachine · 2025-12-04T15:42:36Z

💚 All backports created successfully

Status	Branch	Result
✅	8.19
✅	9.1
✅	9.2

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…5267) # Backport This will backport the following commits from `main` to `9.2`: - [[User profiles] Strict user profile setting keys (#241213)](#241213)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Sid <siddharthmantri1@gmail.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

…5266) # Backport This will backport the following commits from `main` to `9.1`: - [[User profiles] Strict user profile setting keys (#241213)](#241213)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Sid <siddharthmantri1@gmail.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

kibanamachine · 2025-12-05T17:49:16Z

Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync.
cc: @SiddharthMantri

…45265) # Backport This will backport the following commits from `main` to `8.19`: - [[User profiles] Strict user profile setting keys (#241213)](#241213)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Sid <siddharthmantri1@gmail.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

## Summary Adds strict schema validation to the user profile update API endpoint (/internal/security/user_profile/_data) to restrict the request body to just allowed fields. The PR also introduces some reasonable defaults for string length for colors and initials. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [ ] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

SiddharthMantri added 4 commits October 30, 2025 00:33

[User profiles] Strict user profile setting keys

29fb45d

Update unit tests

fe38561

update user profile config tests

2cb6b15

update tests

29bd445

SiddharthMantri marked this pull request as ready for review November 7, 2025 12:43

SiddharthMantri requested a review from a team as a code owner November 7, 2025 12:43

SiddharthMantri added Team:Security Platform Security: Auth, Users, Roles, Spaces, Audit Logging, etc t// release_note:skip Skip the PR/issue when compiling release notes Feature:Security/User Profile labels Nov 7, 2025

Merge branch 'main' into restrict-internal-user-profile-update-data

8962ee6

SiddharthMantri commented Nov 7, 2025

View reviewed changes

SiddharthMantri added 3 commits November 7, 2025 14:13

fix lint issues

9858b59

fix lints

b98b96e

fix cases api tests

ab1f90c

SiddharthMantri requested a review from a team as a code owner November 7, 2025 15:40

SiddharthMantri added 2 commits November 7, 2025 16:42

fix test asserts

dc6073e

fix issue with text assert

7b6cddf

Merge branch 'main' into restrict-internal-user-profile-update-data

50558a2

azasypkin self-requested a review November 12, 2025 17:01

SiddharthMantri mentioned this pull request Nov 13, 2025

[UserProfiles] Consider making UserProfileData allowlist more discoverable via strict types #240851

Closed

SiddharthMantri linked an issue Nov 13, 2025 that may be closed by this pull request

[UserProfiles] Consider making UserProfileData allowlist more discoverable via strict types #240851

Closed

SiddharthMantri added 2 commits November 13, 2025 19:52

use reasonable defaults for max strings lengths

cdbe839

image string

25457b8

SiddharthMantri commented Nov 13, 2025

View reviewed changes

Merge branch 'main' into restrict-internal-user-profile-update-data

0f4fe06

azasypkin approved these changes Dec 2, 2025

View reviewed changes

azasypkin reviewed Dec 2, 2025

View reviewed changes

SiddharthMantri added the backport:all-open Backport to all branches that could still receive a release label Dec 2, 2025

Merge branch 'main' into restrict-internal-user-profile-update-data

ba6c078

SiddharthMantri mentioned this pull request Dec 3, 2025

[User profiles] Avatar colors are too strict #245085

Closed

Merge branch 'main' into restrict-internal-user-profile-update-data

44c1ead

legrego merged commit 90fdc5f into elastic:main Dec 4, 2025
12 checks passed

kibanamachine added the v9.3.0 label Dec 4, 2025

kibanamachine mentioned this pull request Dec 4, 2025

[8.19] [User profiles] Strict user profile setting keys (#241213) #245265

Merged

kibanamachine mentioned this pull request Dec 4, 2025

[9.1] [User profiles] Strict user profile setting keys (#241213) #245266

Merged

kibanamachine mentioned this pull request Dec 4, 2025

[9.2] [User profiles] Strict user profile setting keys (#241213) #245267

Merged

kibanamachine added the v9.2.3 label Dec 4, 2025

kibanamachine added v9.1.9 backport missing Added to PRs automatically when the are determined to be missing a backport. labels Dec 4, 2025

kibanamachine added v8.19.9 and removed backport missing Added to PRs automatically when the are determined to be missing a backport. labels Dec 5, 2025

	export interface UserSettingsData {
	darkMode?: DarkModeValue;
	contrastMode?: ContrastModeValue;
	solutionNavOptOut?: boolean;
	}

Conversation

SiddharthMantri commented Oct 29, 2025 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

Uh oh!

elasticmachine commented Nov 7, 2025

Uh oh!

SiddharthMantri commented Nov 7, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SiddharthMantri commented Nov 11, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SiddharthMantri commented Nov 14, 2025

Uh oh!

azasypkin commented Dec 2, 2025

Uh oh!

azasypkin left a comment

Choose a reason for hiding this comment

Uh oh!

azasypkin Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SiddharthMantri commented Dec 2, 2025

Uh oh!

SiddharthMantri commented Dec 3, 2025

Uh oh!

elasticmachine commented Dec 3, 2025

💚 Build Succeeded

Metrics [docs]

History

Uh oh!

Uh oh!

kibanamachine commented Dec 4, 2025

Uh oh!

kibanamachine commented Dec 4, 2025

💚 All backports created successfully

Questions ?

Uh oh!

kibanamachine commented Dec 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

SiddharthMantri commented Oct 29, 2025 •

edited by kibanamachine

Loading

azasypkin Dec 2, 2025 •

edited

Loading