Fix eslint rule for restricting certain lodash imports (elastic#151023)

Fixes elastic#110422 TL;DR: The `lodash.set` function is unsafe and shouldn't be called. Cause of error: If you specify multiple `no-restricted-imports` paths for the same module, only the last path is used. Instead you need to combine them into a single path as I've done in this PR. This regression was introduced in elastic#100277
watson · Feb 16, 2023 · fbdeffb · fbdeffb
1 parent 8bcd29f
commit fbdeffb
Show file tree

Hide file tree

Showing 68 changed files with 172 additions and 141 deletions.
diff --git a/.eslintrc.js b/.eslintrc.js
@@ -183,50 +183,49 @@ const DEV_PATTERNS = [
 const RESTRICTED_IMPORTS = [
   {
     name: 'lodash',
-    importNames: ['set', 'setWith'],
-    message: 'Please use @kbn/safer-lodash-set instead',
+    importNames: ['set', 'setWith', 'template'],
+    message:
+      'lodash.set/setWith: Please use @kbn/safer-lodash-set instead.\n' +
+      'lodash.template: Function is unsafe, and not compatible with our content security policy.',
   },
   {
     name: 'lodash.set',
-    message: 'Please use @kbn/safer-lodash-set instead',
+    message: 'Please use @kbn/safer-lodash-set/set instead',
   },
   {
     name: 'lodash.setwith',
-    message: 'Please use @kbn/safer-lodash-set instead',
+    message: 'Please use @kbn/safer-lodash-set/setWith instead',
   },
   {
     name: 'lodash/set',
-    message: 'Please use @kbn/safer-lodash-set instead',
+    message: 'Please use @kbn/safer-lodash-set/set instead',
   },
   {
     name: 'lodash/setWith',
-    message: 'Please use @kbn/safer-lodash-set instead',
+    message: 'Please use @kbn/safer-lodash-set/setWith instead',
   },
   {
     name: 'lodash/fp',
-    importNames: ['set', 'setWith', 'assoc', 'assocPath'],
-    message: 'Please use @kbn/safer-lodash-set instead',
+    importNames: ['set', 'setWith', 'assoc', 'assocPath', 'template'],
+    message:
+      'lodash.set/setWith/assoc/assocPath: Please use @kbn/safer-lodash-set/fp instead\n' +
+      'lodash.template: Function is unsafe, and not compatible with our content security policy.',
   },
   {
     name: 'lodash/fp/set',
-    message: 'Please use @kbn/safer-lodash-set instead',
+    message: 'Please use @kbn/safer-lodash-set/fp/set instead',
   },
   {
     name: 'lodash/fp/setWith',
-    message: 'Please use @kbn/safer-lodash-set instead',
+    message: 'Please use @kbn/safer-lodash-set/fp/setWith instead',
   },
   {
     name: 'lodash/fp/assoc',
-    message: 'Please use @kbn/safer-lodash-set instead',
+    message: 'Please use @kbn/safer-lodash-set/fp/assoc instead',
   },
   {
     name: 'lodash/fp/assocPath',
-    message: 'Please use @kbn/safer-lodash-set instead',
-  },
-  {
-    name: 'lodash',
-    importNames: ['template'],
-    message: 'lodash.template is unsafe, and not compatible with our content security policy.',
+    message: 'Please use @kbn/safer-lodash-set/fp/assocPath instead',
   },
   {
     name: 'lodash.template',
@@ -236,11 +235,6 @@ const RESTRICTED_IMPORTS = [
     name: 'lodash/template',
     message: 'lodash.template is unsafe, and not compatible with our content security policy.',
   },
-  {
-    name: 'lodash/fp',
-    importNames: ['template'],
-    message: 'lodash.template is unsafe, and not compatible with our content security policy.',
-  },
   {
     name: 'lodash/fp/template',
     message: 'lodash.template is unsafe, and not compatible with our content security policy.',
@@ -744,47 +738,54 @@ module.exports = {
     {
       files: ['**/*.{js,mjs,ts,tsx}'],
       rules: {
-        'no-restricted-imports': [
-          2,
+        'no-restricted-imports': ['error', ...RESTRICTED_IMPORTS],
+        'no-restricted-modules': [
+          'error',
           {
-            paths: RESTRICTED_IMPORTS,
+            name: 'lodash.set',
+            message: 'Please use @kbn/safer-lodash-set instead',
           },
-        ],
-        'no-restricted-modules': [
-          2,
           {
-            paths: [
-              {
-                name: 'lodash.set',
-                message: 'Please use @kbn/safer-lodash-set instead',
-              },
-              {
-                name: 'lodash.setwith',
-                message: 'Please use @kbn/safer-lodash-set instead',
-              },
-              {
-                name: 'lodash.template',
-                message:
-                  'lodash.template is unsafe, and not compatible with our content security policy.',
-              },
-              {
-                name: 'lodash/set',
-                message: 'Please use @kbn/safer-lodash-set instead',
-              },
-              {
-                name: 'lodash/setWith',
-                message: 'Please use @kbn/safer-lodash-set instead',
-              },
-              {
-                name: 'lodash/template',
-                message:
-                  'lodash.template is unsafe, and not compatible with our content security policy.',
-              },
-            ],
+            name: 'lodash.setwith',
+            message: 'Please use @kbn/safer-lodash-set instead',
+          },
+          {
+            name: 'lodash.template',
+            message:
+              'lodash.template is unsafe, and not compatible with our content security policy.',
+          },
+          {
+            name: 'lodash/set',
+            message: 'Please use @kbn/safer-lodash-set/set instead',
+          },
+          {
+            name: 'lodash/setWith',
+            message: 'Please use @kbn/safer-lodash-set/setWith instead',
+          },
+          {
+            name: 'lodash/fp/set',
+            message: 'Please use @kbn/safer-lodash-set/fp/set instead',
+          },
+          {
+            name: 'lodash/fp/setWith',
+            message: 'Please use @kbn/safer-lodash-set/fp/setWith instead',
+          },
+          {
+            name: 'lodash/fp/assoc',
+            message: 'Please use @kbn/safer-lodash-set/fp/assoc instead',
+          },
+          {
+            name: 'lodash/fp/assocPath',
+            message: 'Please use @kbn/safer-lodash-set/fp/assocPath instead',
+          },
+          {
+            name: 'lodash/template',
+            message:
+              'lodash.template is unsafe, and not compatible with our content security policy.',
           },
         ],
         'no-restricted-properties': [
-          2,
+          'error',
           {
             object: 'lodash',
             property: 'set',
@@ -795,18 +796,6 @@ module.exports = {
             property: 'set',
             message: 'Please use @kbn/safer-lodash-set instead',
           },
-          {
-            object: 'lodash',
-            property: 'template',
-            message:
-              'lodash.template is unsafe, and not compatible with our content security policy.',
-          },
-          {
-            object: '_',
-            property: 'template',
-            message:
-              'lodash.template is unsafe, and not compatible with our content security policy.',
-          },
           {
             object: 'lodash',
             property: 'setWith',
@@ -837,22 +826,30 @@ module.exports = {
             property: 'assocPath',
             message: 'Please use @kbn/safer-lodash-set instead',
           },
+          {
+            object: 'lodash',
+            property: 'template',
+            message:
+              'lodash.template is unsafe, and not compatible with our content security policy.',
+          },
+          {
+            object: '_',
+            property: 'template',
+            message:
+              'lodash.template is unsafe, and not compatible with our content security policy.',
+          },
         ],
       },
     },
     {
       files: ['**/common/**/*.{js,mjs,ts,tsx}', '**/public/**/*.{js,mjs,ts,tsx}'],
       rules: {
         'no-restricted-imports': [
-          2,
+          'error',
+          ...RESTRICTED_IMPORTS,
           {
-            paths: [
-              ...RESTRICTED_IMPORTS,
-              {
-                name: 'semver',
-                message: 'Please use "semver/*/{function}" instead',
-              },
-            ],
+            name: 'semver',
+            message: 'Please use "semver/*/{function}" instead',
           },
         ],
       },

diff --git a/packages/kbn-apm-synthtrace-client/src/lib/utils/dedot.ts b/packages/kbn-apm-synthtrace-client/src/lib/utils/dedot.ts
@@ -5,7 +5,7 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
-import { set } from 'lodash';
+import { set } from '@kbn/safer-lodash-set';
 
 export function dedot(source: Record<string, any>, target: Record<string, any>) {
   // eslint-disable-next-line guard-for-in

diff --git a/packages/kbn-apm-synthtrace-client/tsconfig.json b/packages/kbn-apm-synthtrace-client/tsconfig.json
@@ -14,5 +14,6 @@
   ],
   "kbn_references": [
     "@kbn/datemath",
+    "@kbn/safer-lodash-set",
   ]
 }
diff --git a/packages/kbn-es-query/src/filters/build_filters/phrase_filter.test.ts b/packages/kbn-es-query/src/filters/build_filters/phrase_filter.test.ts
@@ -5,7 +5,7 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
-import { set } from 'lodash';
+import { set } from '@kbn/safer-lodash-set';
 import {
   buildInlineScriptForPhraseFilter,
   buildPhraseFilter,

diff --git a/packages/kbn-es-query/tsconfig.json b/packages/kbn-es-query/tsconfig.json
@@ -15,6 +15,7 @@
   "kbn_references": [
     "@kbn/utility-types",
     "@kbn/i18n",
+    "@kbn/safer-lodash-set",
   ],
   "exclude": [
     "target/**/*",

diff --git a/packages/kbn-interpreter/src/common/lib/ast/to_expression.test.js b/packages/kbn-interpreter/src/common/lib/ast/to_expression.test.js
@@ -7,7 +7,8 @@
  */
 
 import { toExpression } from './to_expression';
-import { cloneDeep, set, unset } from 'lodash';
+import { set } from '@kbn/safer-lodash-set';
+import { cloneDeep, unset } from 'lodash';
 
 describe('toExpression', () => {
   describe('single expression', () => {

diff --git a/packages/kbn-interpreter/tsconfig.json b/packages/kbn-interpreter/tsconfig.json
@@ -13,6 +13,7 @@
     "**/*.js"
   ],
   "kbn_references": [
+    "@kbn/safer-lodash-set",
   ],
   "exclude": [
     "target/**/*",

diff --git a/packages/kbn-safer-lodash-set/README.md b/packages/kbn-safer-lodash-set/README.md
@@ -7,7 +7,7 @@ Lodash v4.x.
 ## Example Usage
 
 ```js
-const { set } = require('@elastic/safer-loadsh-set');
+const { set } = require('@kbn/safer-lodash-set');
 
 const object = { a: [{ b: { c: 3 } }] };
 

diff --git a/src/plugins/controls/server/control_group/control_group_telemetry.ts b/src/plugins/controls/server/control_group/control_group_telemetry.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import { set } from 'lodash';
+import { set } from '@kbn/safer-lodash-set';
 import { PersistableStateService } from '@kbn/kibana-utils-plugin/common';
 import {
   ControlGroupTelemetry,

diff --git a/src/plugins/controls/tsconfig.json b/src/plugins/controls/tsconfig.json
@@ -33,6 +33,7 @@
     "@kbn/config-schema",
     "@kbn/storybook",
     "@kbn/ui-theme",
+    "@kbn/safer-lodash-set",
   ],
   "exclude": [
     "target/**/*",

diff --git a/src/plugins/data_views/common/data_views/data_views.test.ts b/src/plugins/data_views/common/data_views/data_views.test.ts
@@ -6,7 +6,8 @@
  * Side Public License, v 1.
  */
 
-import { defaults, get, set } from 'lodash';
+import { set } from '@kbn/safer-lodash-set';
+import { defaults, get } from 'lodash';
 import { DataViewsService, DataView } from '.';
 import { fieldFormatsMock } from '@kbn/field-formats-plugin/common/mocks';
 

diff --git a/src/plugins/data_views/tsconfig.json b/src/plugins/data_views/tsconfig.json
@@ -26,6 +26,7 @@
     "@kbn/core-test-helpers-http-setup-browser",
     "@kbn/config-schema",
     "@kbn/utility-types-jest",
+    "@kbn/safer-lodash-set",
   ],
   "exclude": [
     "target/**/*",

diff --git a/...ugins/files/server/blob_storage_service/adapters/es/content_stream/content_stream.test.ts b/...ugins/files/server/blob_storage_service/adapters/es/content_stream/content_stream.test.ts
@@ -7,7 +7,7 @@
  */
 
 import type { Logger } from '@kbn/core/server';
-import { set } from 'lodash';
+import { set } from '@kbn/safer-lodash-set';
 import { Readable } from 'stream';
 import { encode } from 'cbor-x';
 import { elasticsearchServiceMock, loggingSystemMock } from '@kbn/core/server/mocks';

diff --git a/src/plugins/files/tsconfig.json b/src/plugins/files/tsconfig.json
@@ -27,6 +27,7 @@
     "@kbn/core-saved-objects-api-server",
     "@kbn/core-logging-server-mocks",
     "@kbn/ecs",
+    "@kbn/safer-lodash-set",
   ],
   "exclude": [
     "target/**/*",

diff --git a/x-pack/plugins/actions/server/lib/create_action_event_log_record_object.ts b/x-pack/plugins/actions/server/lib/create_action_event_log_record_object.ts
@@ -5,7 +5,8 @@
  * 2.0.
  */
 
-import { isEmpty, set } from 'lodash';
+import { set } from '@kbn/safer-lodash-set';
+import { isEmpty } from 'lodash';
 import { IEvent, SAVED_OBJECT_REL_PRIMARY } from '@kbn/event-log-plugin/server';
 import { RelatedSavedObjects } from './related_saved_objects';
 

diff --git a/x-pack/plugins/actions/tsconfig.json b/x-pack/plugins/actions/tsconfig.json
@@ -31,7 +31,8 @@
     "@kbn/std",
     "@kbn/logging",
     "@kbn/logging-mocks",
-    "@kbn/core-elasticsearch-client-server-mocks"
+    "@kbn/core-elasticsearch-client-server-mocks",
+    "@kbn/safer-lodash-set"
   ],
   "exclude": [
     "target/**/*",

diff --git a/x-pack/plugins/alerting/server/lib/rule_run_metrics_store.ts b/x-pack/plugins/alerting/server/lib/rule_run_metrics_store.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { set } from 'lodash';
+import { set } from '@kbn/safer-lodash-set';
 import { ActionsCompletion } from '../types';
 import { ActionsConfigMap } from './get_actions_config_map';
 import { SearchMetrics } from './types';

diff --git a/x-pack/plugins/alerting/server/rules_client/common/apply_bulk_edit_operation.ts b/x-pack/plugins/alerting/server/rules_client/common/apply_bulk_edit_operation.ts
@@ -4,7 +4,8 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import { set, get, isEqual } from 'lodash';
+import { set } from '@kbn/safer-lodash-set';
+import { get, isEqual } from 'lodash';
 import type { BulkEditOperation, BulkEditFields } from '../types';
 
 // defining an union type that will passed directly to generic function as a workaround for the issue similar to

diff --git a/x-pack/plugins/apm/server/routes/fleet/get_package_policy_decorators.ts b/x-pack/plugins/apm/server/routes/fleet/get_package_policy_decorators.ts
@@ -5,7 +5,8 @@
  * 2.0.
  */
 
-import { cloneDeep, get, set } from 'lodash';
+import { set } from '@kbn/safer-lodash-set';
+import { cloneDeep, get } from 'lodash';
 import { NewPackagePolicy } from '@kbn/fleet-plugin/common';
 import { AgentConfiguration } from '../../../common/agent_configuration/configuration_types';
 import { AGENT_NAME } from '../../../common/es_fields/apm';

diff --git a/x-pack/plugins/apm/tsconfig.json b/x-pack/plugins/apm/tsconfig.json
@@ -78,6 +78,7 @@
     "@kbn/core-elasticsearch-server",
     "@kbn/shared-ux-prompt-not-found",
     "@kbn/core-saved-objects-api-server",
+    "@kbn/safer-lodash-set",
     "@kbn/shared-ux-router",
   ],
   "exclude": [