[ResponseOps] add mustache string encoding support

[pmuellr]

extracted from #84217

There have been requests for various sorts of string encoding to be added to our mustache support:

• base64
• url

These should be relatively simple to add along-side our other mustache extensions.

Presumable they would look like this in the mustache template:

{{#EncodeBase64}}{{some-context-variable}}{{/EncodeBase64}}

cc: @shanisagiv1

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[shanisagiv1]

Thanks for opening this.

[MakoWish]

Any progress on this? We have been needing to URL-encode values for a very long time now. We utilize markdown hyperlinks in every one of our Security Detection Rule alerts that link to a dashboard. The links are more often than not filtered by details from the alert. For instance, if process.name has a value, a link is displayed that will take you to a dashboard providing details on that process. Unfortunately, if the process name has a space in it, like Some Application.exe, markdown does not complete the URL properly in the email alert. Same goes for user names like NETWORK SYSTEM, etc.

[MakoWish]

Hey, @pmuellr!

As discussed in Slack, I am posting a little more detail here as to the desire for a sort of {{#EncodeURL}} mustache function.

You saw the template I use for my Security Detection Rule actions. The values for several fields like host.name, user.name, or process.name are hyperlinks to specific dashboards in Kibana using values from the alert. There are often usernames that contain spaces like NETWORK SERVICE, or process names like Some App.exe, that unfortunately break the hyperlink. Here is a screenshot of how the link is broken for a process name with spaces, "Outlook Macro Update.EXE":

If we could URL-encode values, it would ensure that any markdown hyperlinks in alerts will not be broken by values containing invalid characters. In my case, my only issue arises with spaces, so a space to %20 conversion is all I need.

[pmuellr]

I think we'll need to support both encodeURIComponent() and encodeURI(), which are slightly different in which characters they encode. encodeURI() is for when you need to encode an entire URL, so it doesn't encode things like /, ?, etc. But encodeURIComponent() does, and so could be used to do MORE encoding IF you are building the URL dynamically with mustache variables? Are you?

If the complete URL is being provided to you as a mustache variable from the rule, it seems like we should URL already encoded, before making them available as variables. I'm wondering if there is some environment that would NOT be able to deal with properly encoded URLs. Seems unlikely to me.

But if you are constructing the URL from a template, and filling in query string params with mustache variables, I think the only way to do that will be with some encoding lambdas as you suggest.

[MakoWish]

Hate to be a squeaky wheel, but any updates on this? The lack of a URL encoding function in the mustache templating does add a load to my day-to-day activities, because I have to manually grab URL's from my alerts instead of just being able to click on them. It is a pretty big one for me. If there is anything I can do to help push this along, please let me know.

[pmuellr]

I had started something, but am not seeing a PR for it. Let me find that and at least push up what I got ...

[MakoWish]

Hey, @pmuellr ,

I see the draft PR and commit. Any chance we can get this merged? Been waiting quite a long time for this one, hahaha.

[pmuellr]

Ya, sorry about the duration on this one.

As Ying pointed out in the PR, we're going to have to do something different with this mustache lambda, since it should be sensitive to spaces, where all of our other lambdas are basically insensitve to spaces ...

[MakoWish]

Why would it need to be sensitive to spaces? I only see that he mentioned the values should not be trim()'ed.

EDIT: Ah!!! "Spaces" as in " ". I was thinking "spaces" as in the working areas of Kibana.

[MakoWish]

Please, please, please have some updates on this one?! 🙏🏼

It has been a really long time, and I need my alerts to be cleaned up. Any space in a hyperlink pretty much ruins the alert. I am a huge fan of Elastic (and a paying customer), but little things like this make my management ask why it can't be fixed.