How to use Copilot to repair a KQL regex guard
Copilot narrowed Kibana’s KQL template regex and added ReDoS cases; a reviewer approved the merged patch while agent-side checks faced firewall blocks.
github.com
Original prompt
Shared by the source author. See source notes for context.
Please triage the findings as soon as possible
Reach people exploring AI agents
See placements →Evidence at a glance
Sourced account- Source author
- skynetigor
- Original account
- Read the source ↗
- Published
- Source link checked
- Reported result
- The merged patch excludes nested opening braces from both template expressions and adds regression coverage; blocked agent-side validation remains part of the public record.
- Human involvement
- Reviewer rosomri approved the proposal, and skynetigor merged it; Copilot’s firewall prevented a clean bootstrap and focused test run in its environment.
A linked account supports attribution. It does not mean we independently reproduced its result.
Report an issue with this case
Open correction emailOpens your email app with the case link included. Nothing is sent automatically.
How the agent did it
- Copilot inspected the CodeQL finding and the two template-removal expressions in the KQL extractor.
- It narrowed both character classes and added functional and pathological-input regression cases.
- The agent disclosed blocked validation commands, and a human reviewer approved the patch before merge.
A CodeQL alert in Kibana’s KQL property-path extractor became a concrete Copilot coding-agent repair. Two expressions consumed template contents while excluding only closing braces, leaving troublesome opening-brace input inside the match. The request asked for triage of a high-severity finding.
Copilot changed both the complete-template and unfinished-template patterns to exclude opening and closing braces. The public diff also adds coverage for ordinary template values, long strings and malformed template input, keeping functional behavior visible alongside the performance concern.
The execution record includes an important limitation. Copilot attempted repository bootstrap, focused Jest execution and ESLint, but its firewall blocked several required hosts. Added tests therefore should not be confused with a clean agent-side test run.
A human reviewer approved the proposal and skynetigor merged it the same day. The resulting source change is small and inspectable: constrain what the regex may consume, then retain regression cases. This record supports the particular KQL remediation, with environmental failures disclosed; it does not establish that the agent completed a broader Kibana security audit.
Prompt
Original prompt
Source: GitHub · skynetigor
Frequently asked questions
What changed in the expressions?
Their inner match excludes both kinds of brace.
Did Copilot run all checks successfully?
No. The firewall blocked hosts needed by its validation commands.
Was there human review?
Yes. rosomri approved the proposal before it merged.
More details
About this account
Copilot inspected the CodeQL finding and the two template-removal expressions in the KQL extractor. It narrowed both character classes and added functional and pathological-input regression cases.
Original PR, public API, diff and review were opened. Copilot coding-agent attribution and original prompt are explicit. The source uses inconsistent complexity language, so this account describes backtracking without asserting a precise exponential bound. Original prompt excerpt.
Credit: skynetigor — GitHub
Source published
Added to Agents In Use
Source checked
Tools and topics
GitHub Copilot · CodeQL · Jest · TypeScript
ReDoS · code scanning · template parsing
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.