Enable prototype pollution protection in TSVB

[flash1293]

Currently the TSVB endpoint in

kibana/src/plugins/vis_type_timeseries/server/routes/vis.ts

Line 43 in 75a1459

visPayloadSchema.validate(request.body);

is only doing a soft validation based on the provided schema because there are legacy configuration objects currently incompatible with the schema.

To put some protection in place, the same logic as used in core should be applied, failing the request if some known malicious keys are specified somewhere in the request object:

kibana/src/core/server/http/prototype_pollution/validate_object.ts

Line 34 in 1c415e0

export function validateObject(obj: any) {

We should still strive to complete the strict schema to cover all possible configurations in the long term.

Tasks:

• Export the validateObject helper method from core so it's usable in plugins as well
• Use it for the TSVB endpoint along with the soft validation

[elasticmachine]

Pinging @elastic/kibana-app (Team:KibanaApp)

[flash1293]

cc @timroes

[timroes]

@joshdover do you think it would make sense to export this method from core, so every HTTP service could use it instead of copying that code over?

[flash1293]

I guess in theory we want all routes to use strict validation schemes. But that's not always possible (e.g. when piping through Elasticsearch dsl) - for these cases one approach would be to introduce a new option as part of @kbn/config-schema:
schema.object({}, { unknowns: 'allowSafe' }) This would do the recursive check for prototype pollution keys