[alerting] Adds Action Type configuration support and whitelisting

x-pack/legacy/plugins/actions/index.ts

@@ -27,6 +27,14 @@ export function actions(kibana: any) {
       return Joi.object()
         .keys({
           enabled: Joi.boolean().default(false),
+          whitelistedHosts: Joi.alternatives()
+            .try(
+              Joi.array()
+                .items(Joi.string().hostname())
+                .sparse(false),
+              Joi.string().valid('any', 'none')
+            )
+            .default('none'),
         })
         .default();
     },

x-pack/legacy/plugins/actions/server/actions_config.test.ts

@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ActionsKibanaConfig, getActionsConfigurationUtilities } from './actions_config';
+
+describe('isWhitelistedHostname', () => {
+  test('returns true when "any" hostnames are allowed', () => {
+    const config: ActionsKibanaConfig = { enabled: false, whitelistedHosts: 'any' };
+    expect(
+      getActionsConfigurationUtilities(config).isWhitelistedHostname(
+        'https://github.com/elastic/kibana'
+      )
+    ).toEqual(true);
+  });
+
+  test('returns false when the hostname in the requested uri is not in the whitelist', () => {
+    const config: ActionsKibanaConfig = { enabled: false, whitelistedHosts: [] };
+    expect(
+      getActionsConfigurationUtilities(config).isWhitelistedHostname(
+        'https://github.com/elastic/kibana'
+      )
+    ).toEqual(false);
+  });
+
+  test('returns true when the hostname in the requested uri is in the whitelist', () => {
+    const config: ActionsKibanaConfig = { enabled: false, whitelistedHosts: ['github.com'] };
+    expect(
+      getActionsConfigurationUtilities(config).isWhitelistedHostname(
+        'https://github.com/elastic/kibana'
+      )
+    ).toEqual(true);
+  });
+});

x-pack/legacy/plugins/actions/server/actions_config.ts

@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { fromNullable } from 'fp-ts/lib/Option';
+import { URL } from 'url';
+
+export interface ActionsKibanaConfig {
+  enabled: boolean;
+  whitelistedHosts: 'any' | 'none' | string[];
+}
+
+export interface ActionsConfigurationUtilities {
+  isWhitelistedHostname: (uri: string) => boolean;
+}
+
+export function getActionsConfigurationUtilities(
+  config: ActionsKibanaConfig
+): ActionsConfigurationUtilities {
+  return {
+    isWhitelistedHostname(uri: string): boolean {
+      switch (config.whitelistedHosts) {
+        case 'none':
+          return false;
+        case 'any':
+          return true;
+        default:
+          if (Array.isArray(config.whitelistedHosts)) {
+            const urlHostname = new URL(uri).hostname;
+            return fromNullable(
+              config.whitelistedHosts.find(hostname => hostname === urlHostname)
+            ).isSome();
+          }
+          return false;
+      }
+    },
+  };
+}

x-pack/legacy/plugins/actions/server/builtin_action_types/email.test.ts

@@ -9,6 +9,7 @@ jest.mock('./lib/send_email', () => ({
 }));
 
 import { ActionType, ActionTypeExecutorOptions } from '../types';
+import { ActionsConfigurationUtilities } from '../actions_config';
 import { ActionTypeRegistry } from '../action_type_registry';
 import { encryptedSavedObjectsMock } from '../../../encrypted_saved_objects/server/plugin.mock';
 import { taskManagerMock } from '../../../task_manager/task_manager.mock';
@@ -22,6 +23,7 @@ const sendEmailMock = sendEmail as jest.Mock;
 
 const ACTION_TYPE_ID = '.email';
 const NO_OP_FN = () => {};
+const MOCK_KIBANA_CONFIG = { isWhitelistedHostname: () => true } as ActionsConfigurationUtilities;
 
 const services = {
   log: NO_OP_FN,
@@ -48,7 +50,7 @@ beforeAll(() => {
     getBasePath: jest.fn().mockReturnValue(undefined),
   });
 
-  registerBuiltInActionTypes(actionTypeRegistry);
+  registerBuiltInActionTypes(actionTypeRegistry, MOCK_KIBANA_CONFIG);
 
   actionType = actionTypeRegistry.get(ACTION_TYPE_ID);
 });

x-pack/legacy/plugins/actions/server/builtin_action_types/email.ts

@@ -97,17 +97,18 @@ function validateParams(paramsObject: any): string | void {
 }
 
 // action type definition
-
-export const actionType: ActionType = {
-  id: '.email',
-  name: 'email',
-  validate: {
-    config: ConfigSchema,
-    secrets: SecretsSchema,
-    params: ParamsSchema,
-  },
-  executor,
-};
+export function getActionType(): ActionType {
+  return {
+    id: '.email',
+    name: 'email',
+    validate: {
+      config: ConfigSchema,
+      secrets: SecretsSchema,
+      params: ParamsSchema,
+    },
+    executor,
+  };
+}
 
 // action executor
 

x-pack/legacy/plugins/actions/server/builtin_action_types/es_index.test.ts

@@ -9,6 +9,7 @@ jest.mock('./lib/send_email', () => ({
 }));
 
 import { ActionType, ActionTypeExecutorOptions } from '../types';
+import { ActionsConfigurationUtilities } from '../actions_config';
 import { ActionTypeRegistry } from '../action_type_registry';
 import { encryptedSavedObjectsMock } from '../../../encrypted_saved_objects/server/plugin.mock';
 import { taskManagerMock } from '../../../task_manager/task_manager.mock';
@@ -19,6 +20,7 @@ import { ActionParamsType, ActionTypeConfigType } from './es_index';
 
 const ACTION_TYPE_ID = '.index';
 const NO_OP_FN = () => {};
+const MOCK_KIBANA_CONFIG = { isWhitelistedHostname: () => true } as ActionsConfigurationUtilities;
 
 const services = {
   log: NO_OP_FN,
@@ -45,7 +47,7 @@ beforeAll(() => {
     getBasePath: jest.fn().mockReturnValue(undefined),
   });
 
-  registerBuiltInActionTypes(actionTypeRegistry);
+  registerBuiltInActionTypes(actionTypeRegistry, MOCK_KIBANA_CONFIG);
 
   actionType = actionTypeRegistry.get(ACTION_TYPE_ID);
 });

x-pack/legacy/plugins/actions/server/builtin_action_types/es_index.ts

@@ -33,16 +33,17 @@ const ParamsSchema = schema.object({
 });
 
 // action type definition
-
-export const actionType: ActionType = {
-  id: '.index',
-  name: 'index',
-  validate: {
-    config: ConfigSchema,
-    params: ParamsSchema,
-  },
-  executor,
-};
+export function getActionType(): ActionType {
+  return {
+    id: '.index',
+    name: 'index',
+    validate: {
+      config: ConfigSchema,
+      params: ParamsSchema,
+    },
+    executor,
+  };
+}
 
 // action executor
 

x-pack/legacy/plugins/actions/server/builtin_action_types/index.ts

@@ -5,17 +5,23 @@
  */
 
 import { ActionTypeRegistry } from '../action_type_registry';
+import { ActionsConfigurationUtilities } from '../actions_config';
 
-import { actionType as serverLogActionType } from './server_log';
-import { actionType as slackActionType } from './slack';
-import { actionType as emailActionType } from './email';
-import { actionType as indexActionType } from './es_index';
-import { actionType as pagerDutyActionType } from './pagerduty';
+import { getActionType as getServerLogActionType } from './server_log';
+import { getActionType as getSlackActionType } from './slack';
+import { getActionType as getEmailActionType } from './email';
+import { getActionType as getIndexActionType } from './es_index';
+import { getActionType as getPagerDutyActionType } from './pagerduty';
+import { getActionType as getWebhookActionType } from './webhook';
 
-export function registerBuiltInActionTypes(actionTypeRegistry: ActionTypeRegistry) {
-  actionTypeRegistry.register(serverLogActionType);
-  actionTypeRegistry.register(slackActionType);
-  actionTypeRegistry.register(emailActionType);
-  actionTypeRegistry.register(indexActionType);
-  actionTypeRegistry.register(pagerDutyActionType);
+export function registerBuiltInActionTypes(
+  actionTypeRegistry: ActionTypeRegistry,
+  actionsConfigUtils: ActionsConfigurationUtilities
+) {
+  actionTypeRegistry.register(getServerLogActionType());
+  actionTypeRegistry.register(getSlackActionType());
+  actionTypeRegistry.register(getEmailActionType());
+  actionTypeRegistry.register(getIndexActionType());
+  actionTypeRegistry.register(getPagerDutyActionType());
+  actionTypeRegistry.register(getWebhookActionType(actionsConfigUtils));
 }

x-pack/legacy/plugins/actions/server/builtin_action_types/pagerduty.test.ts

@@ -9,6 +9,7 @@ jest.mock('./lib/post_pagerduty', () => ({
 }));
 
 import { ActionType, Services, ActionTypeExecutorOptions } from '../types';
+import { ActionsConfigurationUtilities } from '../actions_config';
 import { ActionTypeRegistry } from '../action_type_registry';
 import { taskManagerMock } from '../../../task_manager/task_manager.mock';
 import { encryptedSavedObjectsMock } from '../../../encrypted_saved_objects/server/plugin.mock';
@@ -21,6 +22,7 @@ const postPagerdutyMock = postPagerduty as jest.Mock;
 
 const ACTION_TYPE_ID = '.pagerduty';
 const NO_OP_FN = () => {};
+const MOCK_KIBANA_CONFIG = { isWhitelistedHostname: () => true } as ActionsConfigurationUtilities;
 
 const services: Services = {
   log: NO_OP_FN,
@@ -46,7 +48,7 @@ beforeAll(() => {
     spaceIdToNamespace: jest.fn().mockReturnValue(undefined),
     getBasePath: jest.fn().mockReturnValue(undefined),
   });
-  registerBuiltInActionTypes(actionTypeRegistry);
+  registerBuiltInActionTypes(actionTypeRegistry, MOCK_KIBANA_CONFIG);
   actionType = actionTypeRegistry.get(ACTION_TYPE_ID);
 });
 

x-pack/legacy/plugins/actions/server/builtin_action_types/pagerduty.ts

@@ -84,17 +84,18 @@ function validateParams(paramsObject: any): string | void {
 }
 
 // action type definition
-
-export const actionType: ActionType = {
-  id: '.pagerduty',
-  name: 'pagerduty',
-  validate: {
-    config: ConfigSchema,
-    secrets: SecretsSchema,
-    params: ParamsSchema,
-  },
-  executor,
-};
+export function getActionType(): ActionType {
+  return {
+    id: '.pagerduty',
+    name: 'pagerduty',
+    validate: {
+      config: ConfigSchema,
+      secrets: SecretsSchema,
+      params: ParamsSchema,
+    },
+    executor,
+  };
+}
 
 // action executor
 

x-pack/legacy/plugins/actions/server/builtin_action_types/server_log.test.ts

@@ -5,6 +5,7 @@
  */
 
 import { ActionType, Services } from '../types';
+import { ActionsConfigurationUtilities } from '../actions_config';
 import { ActionTypeRegistry } from '../action_type_registry';
 import { taskManagerMock } from '../../../task_manager/task_manager.mock';
 import { encryptedSavedObjectsMock } from '../../../encrypted_saved_objects/server/plugin.mock';
@@ -15,6 +16,7 @@ import { registerBuiltInActionTypes } from './index';
 
 const ACTION_TYPE_ID = '.server-log';
 const NO_OP_FN = () => {};
+const MOCK_KIBANA_CONFIG = { isWhitelistedHostname: () => true } as ActionsConfigurationUtilities;
 
 const services: Services = {
   log: NO_OP_FN,
@@ -39,7 +41,7 @@ beforeAll(() => {
     spaceIdToNamespace: jest.fn().mockReturnValue(undefined),
     getBasePath: jest.fn().mockReturnValue(undefined),
   });
-  registerBuiltInActionTypes(actionTypeRegistry);
+  registerBuiltInActionTypes(actionTypeRegistry, MOCK_KIBANA_CONFIG);
 });
 
 beforeEach(() => {

x-pack/legacy/plugins/actions/server/builtin_action_types/server_log.ts

@@ -21,15 +21,16 @@ const ParamsSchema = schema.object({
 });
 
 // action type definition
-
-export const actionType: ActionType = {
-  id: '.server-log',
-  name: 'server-log',
-  validate: {
-    params: ParamsSchema,
-  },
-  executor,
-};
+export function getActionType(): ActionType {
+  return {
+    id: '.server-log',
+    name: 'server-log',
+    validate: {
+      params: ParamsSchema,
+    },
+    executor,
+  };
+}
 
 // action executor
 

x-pack/legacy/plugins/actions/server/builtin_action_types/slack.ts

@@ -35,9 +35,9 @@ const ParamsSchema = schema.object({
 // action type definition
 
 // customizing executor is only used for tests
-export function getActionType({ executor }: { executor?: ExecutorType } = {}): ActionType {
-  if (executor == null) executor = slackExecutor;
-
+export function getActionType(
+  { executor }: { executor: ExecutorType } = { executor: slackExecutor }
+): ActionType {
   return {
     id: '.slack',
     name: 'slack',
@@ -49,9 +49,6 @@ export function getActionType({ executor }: { executor?: ExecutorType } = {}): A
   };
 }
 
-// the production executor for this action
-export const actionType = getActionType();
-
 // action executor
 
 async function slackExecutor(