fix(kibana-security-health-check): track only selected injected metad…

…ata fields
secutils-dev · Dec 9, 2023 · 35c8a70 · 35c8a70
1 parent 292389a
commit 35c8a70
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/kibana-security-health-check/src/index.ts b/kibana-security-health-check/src/index.ts
@@ -25,6 +25,8 @@ const TRACKED_RESPONSE_HEADERS = [
   'x-frame-options',
 ];
 
+const TRACKED_INJECTED_METADATA = ['anonymousStatusPage', 'clusterInfo', 'csp', 'env', 'externalUrl'];
+
 export async function run(
   previousContent: State | undefined,
   remoteResources: WebPageResource[],
@@ -47,6 +49,7 @@ export async function run(
   const injectedMetadata = JSON.parse(
     dom.querySelector('kbn-injected-metadata')?.getAttribute('data') ?? '{}',
   ) as Record<string, unknown>;
+
   return {
     headers: Object.fromEntries(
       Object.entries(responseHeaders).filter(([key]) => TRACKED_RESPONSE_HEADERS.includes(key.toLowerCase())),
@@ -59,7 +62,9 @@ export async function run(
         3,
       ),
     },
-    injectedMetadata,
+    injectedMetadata: Object.fromEntries(
+      Object.entries(injectedMetadata).filter(([key]) => TRACKED_INJECTED_METADATA.includes(key)),
+    ),
   };
 }
 function formatBytes(bytes: number, decimals: number) {