Skip to content

packages/aws/data_stream/config: guard against null API response fields - #18787

Merged
efd6 merged 1 commit into
elastic:mainfrom
efd6:aws_config_null_results
May 5, 2026
Merged

packages/aws/data_stream/config: guard against null API response fields#18787
efd6 merged 1 commit into
elastic:mainfrom
efd6:aws_config_null_results

Conversation

@efd6

@efd6 efd6 commented May 4, 2026

Copy link
Copy Markdown
Contributor

Proposed commit message

packages/aws/data_stream/config: guard against null API response fields

The CEL program calls size() on body.EvaluationResults after checking
has(), but has() returns true when the field is present with a JSON
null value. size(null) has no overload, producing a runtime error that
propagates to the ternary operator as "no such overload".

Add != null guards to all three has()+size() patterns in the program
(EvaluationResults and ConfigRules). Remove dead .orValue([]) on the
map call since the true branch already guarantees a non-empty list.

Update the test input to return null instead of an empty array for one
rule so the fix is exercised by system tests.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots

@efd6 efd6 self-assigned this May 4, 2026
@efd6 efd6 added Integration:aws AWS bugfix Pull request that fixes a bug issue Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels May 4, 2026
The CEL program calls size() on body.EvaluationResults after checking
has(), but has() returns true when the field is present with a JSON
null value. size(null) has no overload, producing a runtime error that
propagates to the ternary operator as "no such overload".

Add != null guards to all three has()+size() patterns in the program
(EvaluationResults and ConfigRules). Remove dead .orValue([]) on the
map call since the true branch already guarantees a non-empty list.

Update the test input to return null instead of an empty array for one
rule so the fix is exercised by system tests.
@efd6
efd6 force-pushed the aws_config_null_results branch from 932a81e to 8b84c4a Compare May 4, 2026 23:24
Comment thread packages/aws/changelog.yml
@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@elasticmachine

Copy link
Copy Markdown

💚 Build Succeeded

cc @efd6

@efd6
efd6 marked this pull request as ready for review May 5, 2026 01:48
@efd6
efd6 requested review from a team as code owners May 5, 2026 01:48
@infra-vault-gh-plugin-prod

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@kcreddy kcreddy left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@efd6
efd6 merged commit 6b8436b into elastic:main May 5, 2026
10 checks passed
@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

Package aws - 6.14.1 containing this change is available at https://epr.elastic.co/package/aws/6.14.1/

herrBez pushed a commit to herrBez/integrations that referenced this pull request Jun 1, 2026
…ds (elastic#18787)

The CEL program calls size() on body.EvaluationResults after checking
has(), but has() returns true when the field is present with a JSON
null value. size(null) has no overload, producing a runtime error that
propagates to the ternary operator as "no such overload".

Add != null guards to all three has()+size() patterns in the program
(EvaluationResults and ConfigRules). Remove dead .orValue([]) on the
map call since the true branch already guarantees a non-empty list.

Update the test input to return null instead of an empty array for one
rule so the fix is exercised by system tests.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Pull request that fixes a bug issue Integration:aws AWS Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

3 participants