[Security Solution] Fix "unbounded array" code scanner warning for prebuilt rule assets by nikitaindik · Pull Request #255741 · elastic/kibana

nikitaindik · 2026-03-03T11:12:00Z

Resolves: https://github.com/elastic/kibana/security/code-scanning/2072

Summary

Adds a maxSize constraint to the tags field in the security-rule saved object schema (prebuilt_rule_assets_type.ts), resolving CodeQL alert #2072 (unbounded-array-in-schema).

Introduced a MAX_TAGS_PER_RULE constant (100) to bound the schema.arrayOf() call
Prebuilt rules typically have fewer than 15 tags, so 100 is a generous safe limit
No model version bump needed since this is a validation-only change with no structural/mapping impact

Adds a maxSize constraint to the tags field in the prebuilt rule assets saved object schema to resolve CodeQL alert elastic#2072 (unbounded-array-in-schema). Made-with: Cursor

elasticmachine · 2026-03-03T11:15:29Z

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

elasticmachine · 2026-03-03T11:15:33Z

Pinging @elastic/security-detections-response (Team:Detections and Resp)

elasticmachine · 2026-03-03T11:15:33Z

Pinging @elastic/security-solution (Team: SecuritySolution)

...on/server/lib/detection_engine/prebuilt_rules/logic/rule_assets/prebuilt_rule_assets_type.ts

…tion_tests/ci_checks

elasticmachine · 2026-03-05T16:14:49Z

💔 Build Failed

Buildkite Build
Commit: 293d078

Failed CI Steps

Test Failures

[job] [logs] Scout: [ platform / dashboard-stateful-classic ] plugin / local-stateful-classic - dashboard REST schema - Registered embeddable schemas have not changed

Metrics [docs]

✅ unchanged

History

💔 Build #403611 failed d178179
💔 Build #403600 failed cb124ca

cc @nikitaindik

gsoldevila

Changes LGTM! You can disregard the `Check Saved Objects changes" soft failure, as you have schema-only changes.

banderror

Thanks @nikitaindik, LGTM!

banderror · 2026-03-06T12:42:09Z

@nikitaindik Is it worth backporting to active branches?

nikitaindik · 2026-03-06T12:51:59Z

@banderror This CodeQL is running only on main, so no need to backport.

…ebuilt rule assets (elastic#255741) **Resolves: https://github.com/elastic/kibana/security/code-scanning/2072** ## Summary Adds a `maxSize` constraint to the `tags` field in the `security-rule` saved object schema (`prebuilt_rule_assets_type.ts`), resolving [CodeQL alert elastic#2072](https://github.com/elastic/kibana/security/code-scanning/2072) (unbounded-array-in-schema). - Introduced a `MAX_TAGS_PER_RULE` constant (100) to bound the `schema.arrayOf()` call - Prebuilt rules typically have fewer than 15 tags, so 100 is a generous safe limit - No model version bump needed since this is a validation-only change with no structural/mapping impact --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…without a version bump (#256432) ## Summary When a saved object type's schema validation constraints are tightened (e.g. adding a `maxSize` limit to an array field) without touching the underlying ES mappings, the 'Check changes in Saved Objects' CI check was incorrectly rejecting the change as a forbidden model version mutation. This PR relaxes the validation to allow schema-only changes to the **latest** model version, provided all three conditions hold: - Only the latest model version's schemas were modified (no older versions touched). - The mappings have not been modified. - The latest model version's schema still covers all mapped fields (`validateAllMappingsInModelVersion` still passes). When this exceptional case is detected, a warning is emitted in the CI output making it clear why the change is allowed and reminding that any future mapping changes will still require a proper model version bump. ## Context Fixes the CI failure on #255741, where adding a `maxSize` constraint to the `tags` field in the `security-rule` SO type caused the check to fail. Tracking task: elastic/kibana-team#3021 (sub-issue of elastic/kibana-team#2349) Made with [Cursor](https://cursor.com)

…ebuilt rule assets (elastic#255741) **Resolves: https://github.com/elastic/kibana/security/code-scanning/2072** ## Summary Adds a `maxSize` constraint to the `tags` field in the `security-rule` saved object schema (`prebuilt_rule_assets_type.ts`), resolving [CodeQL alert elastic#2072](https://github.com/elastic/kibana/security/code-scanning/2072) (unbounded-array-in-schema). - Introduced a `MAX_TAGS_PER_RULE` constant (100) to bound the `schema.arrayOf()` call - Prebuilt rules typically have fewer than 15 tags, so 100 is a generous safe limit - No model version bump needed since this is a validation-only change with no structural/mapping impact --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…without a version bump (#256432) ## Summary When a saved object type's schema validation constraints are tightened (e.g. adding a `maxSize` limit to an array field) without touching the underlying ES mappings, the 'Check changes in Saved Objects' CI check was incorrectly rejecting the change as a forbidden model version mutation. This PR relaxes the validation to allow schema-only changes to the **latest** model version, provided all three conditions hold: - Only the latest model version's schemas were modified (no older versions touched). - The mappings have not been modified. - The latest model version's schema still covers all mapped fields (`validateAllMappingsInModelVersion` still passes). When this exceptional case is detected, a warning is emitted in the CI output making it clear why the change is allowed and reminding that any future mapping changes will still require a proper model version bump. ## Context Fixes the CI failure on #255741, where adding a `maxSize` constraint to the `tags` field in the `security-rule` SO type caused the check to fail. Tracking task: https://github.com/elastic/kibana-team/issues/3021 (sub-issue of https://github.com/elastic/kibana-team/issues/2349) Made with [Cursor](https://cursor.com)

…without a version bump (elastic#256432) ## Summary When a saved object type's schema validation constraints are tightened (e.g. adding a `maxSize` limit to an array field) without touching the underlying ES mappings, the 'Check changes in Saved Objects' CI check was incorrectly rejecting the change as a forbidden model version mutation. This PR relaxes the validation to allow schema-only changes to the **latest** model version, provided all three conditions hold: - Only the latest model version's schemas were modified (no older versions touched). - The mappings have not been modified. - The latest model version's schema still covers all mapped fields (`validateAllMappingsInModelVersion` still passes). When this exceptional case is detected, a warning is emitted in the CI output making it clear why the change is allowed and reminding that any future mapping changes will still require a proper model version bump. ## Context Fixes the CI failure on elastic#255741, where adding a `maxSize` constraint to the `tags` field in the `security-rule` SO type caused the check to fail. Tracking task: elastic/kibana-team#3021 (sub-issue of elastic/kibana-team#2349) Made with [Cursor](https://cursor.com)

fix: add maxSize to unbounded arrayOf in prebuilt rule assets schema

cb124ca

Adds a maxSize constraint to the tags field in the prebuilt rule assets saved object schema to resolve CodeQL alert elastic#2072 (unbounded-array-in-schema). Made-with: Cursor

nikitaindik requested a review from a team as a code owner March 3, 2026 11:12

nikitaindik added the release_note:skip Skip the PR/issue when compiling release notes label Mar 3, 2026

nikitaindik requested a review from maximpn March 3, 2026 11:12

nikitaindik self-assigned this Mar 3, 2026

nikitaindik added the v9.4.0 label Mar 3, 2026

nikitaindik changed the title ~~fix: add maxSize to unbounded arrayOf in prebuilt rule assets schema~~ [Security Solution] Fix "unbounded array" code scanner warning for prebuilt rule assets Mar 3, 2026

banderror reviewed Mar 3, 2026

View reviewed changes

...on/server/lib/detection_engine/prebuilt_rules/logic/rule_assets/prebuilt_rule_assets_type.ts Show resolved Hide resolved

Changes from node scripts/jest_integration -u src/core/server/integra…

d178179

…tion_tests/ci_checks

elastic-vault-github-plugin-prod bot requested a review from a team as a code owner March 3, 2026 11:27

Merge branch 'main' into fix/unbounded-array-schema-prebuilt-rules

293d078

nikitaindik requested a review from banderror March 5, 2026 16:58

gsoldevila approved these changes Mar 6, 2026

View reviewed changes

gsoldevila mentioned this pull request Mar 6, 2026

[SavedObjects] Allow schema-only changes in the latest model version without a version bump #256432

Merged

banderror approved these changes Mar 6, 2026

View reviewed changes

banderror removed the request for review from maximpn March 6, 2026 12:39

nikitaindik merged commit 50e16fe into elastic:main Mar 6, 2026
16 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] Fix "unbounded array" code scanner warning for prebuilt rule assets#255741

[Security Solution] Fix "unbounded array" code scanner warning for prebuilt rule assets#255741
nikitaindik merged 3 commits intoelastic:mainfrom
nikitaindik:fix/unbounded-array-schema-prebuilt-rules

nikitaindik commented Mar 3, 2026 •

edited

Loading

Uh oh!

elasticmachine commented Mar 3, 2026

Uh oh!

elasticmachine commented Mar 3, 2026

Uh oh!

elasticmachine commented Mar 3, 2026

Uh oh!

Uh oh!

elasticmachine commented Mar 5, 2026 •

edited

Loading

Uh oh!

gsoldevila left a comment

Uh oh!

banderror left a comment

Uh oh!

Uh oh!

banderror commented Mar 6, 2026

Uh oh!

nikitaindik commented Mar 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

nikitaindik commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

elasticmachine commented Mar 3, 2026

Uh oh!

elasticmachine commented Mar 3, 2026

Uh oh!

elasticmachine commented Mar 3, 2026

Uh oh!

Uh oh!

elasticmachine commented Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💔 Build Failed

Failed CI Steps

Test Failures

Metrics [docs]

History

Uh oh!

gsoldevila left a comment

Choose a reason for hiding this comment

Uh oh!

banderror left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

banderror commented Mar 6, 2026

Uh oh!

nikitaindik commented Mar 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

nikitaindik commented Mar 3, 2026 •

edited

Loading

elasticmachine commented Mar 5, 2026 •

edited

Loading