From 6691490c858c09a6fa92a474c4f3e86e1b6c6d80 Mon Sep 17 00:00:00 2001
From: Tomasz Ciecierski <ciecierskitomek@gmail.com>
Date: Fri, 6 May 2022 13:07:40 +0200
Subject: [PATCH] remove multi spaces

---
 .../common/utils/build_query/remove_multilines.ts        | 9 +++++++++
 .../public/packs/queries/ecs_mapping_editor_field.tsx    | 3 ++-
 x-pack/plugins/osquery/server/routes/pack/utils.test.ts  | 2 +-
 x-pack/plugins/osquery/server/routes/pack/utils.ts       | 3 ++-
 x-pack/test/api_integration/apis/osquery/packs.ts        | 2 +-
 5 files changed, 15 insertions(+), 4 deletions(-)
 create mode 100644 x-pack/plugins/osquery/common/utils/build_query/remove_multilines.ts

diff --git a/x-pack/plugins/osquery/common/utils/build_query/remove_multilines.ts b/x-pack/plugins/osquery/common/utils/build_query/remove_multilines.ts
new file mode 100644
index 0000000000000..66208a0c7524d
--- /dev/null
+++ b/x-pack/plugins/osquery/common/utils/build_query/remove_multilines.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const removeMultilines = (query: string): string =>
+  query.replaceAll('\n', ' ').replaceAll(/  +/g, ' ');
diff --git a/x-pack/plugins/osquery/public/packs/queries/ecs_mapping_editor_field.tsx b/x-pack/plugins/osquery/public/packs/queries/ecs_mapping_editor_field.tsx
index bb6312e5d3a33..32a7a624888e3 100644
--- a/x-pack/plugins/osquery/public/packs/queries/ecs_mapping_editor_field.tsx
+++ b/x-pack/plugins/osquery/public/packs/queries/ecs_mapping_editor_field.tsx
@@ -59,6 +59,7 @@ import {
   FormArrayField,
 } from '../../shared_imports';
 import { OsqueryIcon } from '../../components/osquery_icon';
+import { removeMultilines } from '../../../common/utils/build_query/remove_multilines';
 
 export const CommonUseField = getUseField({ component: Field });
 
@@ -746,7 +747,7 @@ export const ECSMappingEditorField = React.memo(
         return;
       }
 
-      const oneLineQuery = query.replaceAll('\n', ' ').replaceAll('  ', ' ');
+      const oneLineQuery = removeMultilines(query);
 
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       let ast: Record<string, any> | undefined;
diff --git a/x-pack/plugins/osquery/server/routes/pack/utils.test.ts b/x-pack/plugins/osquery/server/routes/pack/utils.test.ts
index f5518945bd1a5..d5a1b69ae7eff 100644
--- a/x-pack/plugins/osquery/server/routes/pack/utils.test.ts
+++ b/x-pack/plugins/osquery/server/routes/pack/utils.test.ts
@@ -35,7 +35,7 @@ const oneLiner = {
   default: {
     ecs_mapping: {},
     interval: 3600,
-    query: `select u.username,    p.pid,    p.name,    pos.local_address,    pos.local_port,    p.path,    p.cmdline,    pos.remote_address,    pos.remote_port from processes as p join users as u   on u.uid=p.uid join process_open_sockets as pos   on pos.pid=p.pid where pos.remote_port !='0' limit 1000;`,
+    query: `select u.username, p.pid, p.name, pos.local_address, pos.local_port, p.path, p.cmdline, pos.remote_address, pos.remote_port from processes as p join users as u on u.uid=p.uid join process_open_sockets as pos on pos.pid=p.pid where pos.remote_port !='0' limit 1000;`,
   },
 };
 
diff --git a/x-pack/plugins/osquery/server/routes/pack/utils.ts b/x-pack/plugins/osquery/server/routes/pack/utils.ts
index 32787e4a01acb..0866caa352e69 100644
--- a/x-pack/plugins/osquery/server/routes/pack/utils.ts
+++ b/x-pack/plugins/osquery/server/routes/pack/utils.ts
@@ -6,6 +6,7 @@
  */
 
 import { pick, reduce } from 'lodash';
+import { removeMultilines } from '../../../common/utils/build_query/remove_multilines';
 import { convertECSMappingToArray, convertECSMappingToObject } from '../utils';
 
 // @ts-expect-error update types
@@ -35,7 +36,7 @@ export const convertSOQueriesToPack = (queries, removeMultiLines?: boolean) =>
       const index = queryId ? queryId : key;
       acc[index] = {
         ...rest,
-        query: removeMultiLines ? query.replaceAll('\n', ' ').replaceAll('  ', ' ') : query,
+        query: removeMultiLines ? removeMultilines(query) : query,
         ecs_mapping: convertECSMappingToObject(ecs_mapping),
       };
 
diff --git a/x-pack/test/api_integration/apis/osquery/packs.ts b/x-pack/test/api_integration/apis/osquery/packs.ts
index b1f9c79015be5..543c01ac92c41 100644
--- a/x-pack/test/api_integration/apis/osquery/packs.ts
+++ b/x-pack/test/api_integration/apis/osquery/packs.ts
@@ -24,7 +24,7 @@ const getDefaultPack = ({ policyIds = [] }: { policyIds?: string[] }) => ({
 });
 
 const singleLineQuery =
-  "select u.username,    p.pid,    p.name,    pos.local_address,    pos.local_port,    p.path,    p.cmdline,    pos.remote_address,    pos.remote_port from processes as p join users as u   on u.uid=p.uid join process_open_sockets as pos   on pos.pid=p.pid where pos.remote_port !='0' limit 1000;";
+  "select u.username, p.pid, p.name, pos.local_address, pos.local_port, p.path, p.cmdline, pos.remote_address, pos.remote_port from processes as p join users as u on u.uid=p.uid join process_open_sockets as pos on pos.pid=p.pid where pos.remote_port !='0' limit 1000;";
 const multiLineQuery = `select u.username,
        p.pid,
        p.name,