[imperva_cloud_waf] Encode spaces in URL

[navnit-elastic]

Proposed commit message

imperval_cloud_waf: encode spaces and prepend scheme in URL

This change replaces spaces with '%20' in URL to ensure
proper encoding. Prepends the scheme to the URL, as
the 'uri_parts' processor requires a fully qualified URL.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Pipeline Tests:

--- Test results for package: imperva_cloud_waf - START ---
╭───────────────────┬─────────────┬───────────┬────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE           │ DATA STREAM │ TEST TYPE │ TEST NAME                                  │ RESULT │ TIME ELAPSED │
├───────────────────┼─────────────┼───────────┼────────────────────────────────────────────┼────────┼──────────────┤
│ imperva_cloud_waf │ event       │ pipeline  │ (ingest pipeline warnings test-event.json) │ PASS   │ 415.785086ms │
│ imperva_cloud_waf │ event       │ pipeline  │ test-event.json                            │ PASS   │ 257.979149ms │
╰───────────────────┴─────────────┴───────────┴────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: imperva_cloud_waf - END   ---
Done

Related issues

• Closes [Imperva Cloud WAF]: URI Parts processor can't handle whitespace in URL #14138

Screenshots

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[efd6]

I think we should also check that neither of these is ''.

Note also that this can be a set processor:

- set:
    field: url.original
    value: '{{{network.application}}}://{{{url.original}}}'
    if: ctx.url?.original != null && ctx.url.original != '' && ctx.network?.application != null && ctx.network.application != ''

[navnit-elastic]

Yes, this looks more reliable. Thanks!

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 2d6ab14

History

• 💚 Build #27200 succeeded 04e5d07

cc @navnit-elastic

[efd6]

We may have additional issues with this since there are other codepoints that must be percent encoded. Let's revisit if they become an issue.

[elastic-vault-github-plugin-prod]

Package imperva_cloud_waf - 1.12.1 containing this change is available at https://epr.elastic.co/package/imperva_cloud_waf/1.12.1/