How to use Copilot to repair a KQL regex guard
Copilot narrowed Kibana’s KQL template regex and added ReDoS cases; a reviewer approved the merged patch while agent-side checks faced firewall blocks.
github.com
Original prompt
Shared by the source author. See source notes for context.
Please triage the findings as soon as possible
Reach people exploring AI agents
See placements →What happened
The merged patch excludes nested opening braces from both template expressions and adds regression coverage; blocked agent-side validation remains part of the public record.
Reported by skynetigor — GitHubHow the agent did it
- Copilot inspected the CodeQL finding and the two template-removal expressions in the KQL extractor.
- It narrowed both character classes and added functional and pathological-input regression cases.
- The agent disclosed blocked validation commands, and a human reviewer approved the patch before merge.
Where a person stepped in
Reviewer rosomri approved the proposal, and skynetigor merged it; Copilot’s firewall prevented a clean bootstrap and focused test run in its environment.
A CodeQL alert in Kibana’s KQL property-path extractor became a concrete Copilot coding-agent repair. Two expressions consumed template contents while excluding only closing braces, leaving troublesome opening-brace input inside the match. The request asked for triage of a high-severity finding.
Copilot changed both the complete-template and unfinished-template patterns to exclude opening and closing braces. The public diff also adds coverage for ordinary template values, long strings and malformed template input, keeping functional behavior visible alongside the performance concern.
The execution record includes an important limitation. Copilot attempted repository bootstrap, focused Jest execution and ESLint, but its firewall blocked several required hosts. Added tests therefore should not be confused with a clean agent-side test run.
A human reviewer approved the proposal and skynetigor merged it the same day. The resulting source change is small and inspectable: constrain what the regex may consume, then retain regression cases. This record supports the particular KQL remediation, with environmental failures disclosed; it does not establish that the agent completed a broader Kibana security audit.
Prompt
Original prompt
Source: GitHub · skynetigor
Frequently asked questions
What changed in the expressions?
Their inner match excludes both kinds of brace.
Did Copilot run all checks successfully?
No. The firewall blocked hosts needed by its validation commands.
Was there human review?
Yes. rosomri approved the proposal before it merged.
More details
About this account
Copilot inspected the CodeQL finding and the two template-removal expressions in the KQL extractor. It narrowed both character classes and added functional and pathological-input regression cases.
Original PR, public API, diff and review were opened. Copilot coding-agent attribution and original prompt are explicit. The source uses inconsistent complexity language, so this account describes backtracking without asserting a precise exponential bound. Original prompt excerpt.
Credit: skynetigor — GitHub
Source published 20 Jan 2026
Source checked 14 Oct 2026
Tools and topics
GitHub Copilot · CodeQL · Jest · TypeScript
ReDoS · code scanning · template parsing
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.