[Kibana] SavedObject client mutates the KueryNode filter object

[cnasikas]

When you pass a KueryNode object as a filter to a method of the saved object’s API the object is being mutated by the API. This can lead to errors if the same filter is used in coming requests that use the same filter. Example:

const options = { filter: nodeBuilder.is('cases.attributes.status', 'open') };
const stats = await client.find({
        fields: [],
        page: 1,
        perPage: 1,
        sortField: defaultSortField,
        ...options,
        type: CASE_SAVED_OBJECT,
      });

return client.find({
        page: 1,
        perPage: stats.total,
        sortField: defaultSortField,
        ...options,
        type: CASE_SAVED_OBJECT,
      });

The filter will be nodeBuilder.is('cases.status', 'open') in the second call and will lead to error.

Using cloneDeep(options) make it work.

[elasticmachine]

Pinging @elastic/kibana-core (Team:Core)

[pgayvallet]

We do rewrite the filter's fields to convert from the SO attribute model to the underlying ES document fields.

When filter is passed as a string, we create the KueryNode internally, but when a real KueryNode is provided, the validation process mutates the input.

const filter = nodeBuilder.is('cases.attributes.status', 'open')
validateConvertFilterToKueryNode(['cases'], filter, mappings); // pass
validateConvertFilterToKueryNode(['cases'], filter, mappings); // fails

I guess we should internally deepClone the KueryNode when provided directly. I don't think it should have any significant performance impact.

kibana/src/core/server/saved_objects/service/lib/filter_utils.ts

Lines 19 to 26 in 0c2495a

	export const validateConvertFilterToKueryNode = (
	allowedTypes: string[],
	filter: string | KueryNode,
	indexMapping: IndexMapping
	): KueryNode | undefined => {
	if (filter && indexMapping) {
	const filterKueryNode =
	typeof filter === 'string' ? esKuery.fromKueryExpression(filter) : filter;