sdd_all: use triple-brace templating

[efd6]

Proposed commit message

sdd_all: use triple-brace templating

The mustache templating system used by ingest pipelines has two levels of
escaping available, not escaped (triple stache) and HTML escaped
(double stache) — see man mustache[1] under "tag types: variables". This can
lead to data corruption, particularly in cases where an operating system has
chosen to use a character requiring escaping in its path syntax.

[1]http://mustache.github.io/mustache.5.html

[git-generate]
for f in $(
	(
		for p in $(
			yq 'select(.owner.github == "elastic/sec-deployment-and-devices")|.name' packages/**/manifest.yml \
			| grep -v -- '---'
		); do
			rg -l -g '*.yml' ": ('\{\{[^{][ .a-zA-Z0-9_]*[^}]}}'|\"\{\{[^{][ .a-zA-Z0-9_]*[^}]}}\")" packages/$p
		done
	)|grep "elasticsearch/ingest_pipeline"|sort|uniq
); do
	sed -i -r "s/: (['\"])\{\{([^{][ .a-zA-Z0-9_]*[^}])}}['\"]/: \1{{{\2}}}\1/g" $f
done
for p in $(git diff --name-only HEAD~1|cut -d/ -f1,2|sort|uniq); do
	(
		cd $p
		elastic-package test pipeline -g
		elastic-package changelog add \
			--description "Use triple-brace Mustache templating when referencing variables in ingest pipelines." \
			--type bugfix \
			--next patch \
			--link https://github.com/elastic/integrations/pull/11286
	)>/dev/null 2>&1
done

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• For sei: packages potentially using incorrect mustache snippet escaping #7641

Screenshots

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 58de75f

History

• 💚 Build #16648 succeeded 434968daf8e76ed3cec2b74980162396ced41f17

cc @efd6

[elastic-sonarqube]

Quality Gate failed

Failed conditions
76.8% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube

[elastic-vault-github-plugin-prod]

Package bluecoat - 0.17.3 containing this change is available at https://epr.elastic.co/search?package=bluecoat

[elastic-vault-github-plugin-prod]

Package cef - 2.17.3 containing this change is available at https://epr.elastic.co/search?package=cef

[elastic-vault-github-plugin-prod]

Package checkpoint - 1.34.1 containing this change is available at https://epr.elastic.co/search?package=checkpoint

[elastic-vault-github-plugin-prod]

Package cisco_ise - 1.23.1 containing this change is available at https://epr.elastic.co/search?package=cisco_ise

[elastic-vault-github-plugin-prod]

Package citrix_waf - 1.16.1 containing this change is available at https://epr.elastic.co/search?package=citrix_waf

[elastic-vault-github-plugin-prod]

Package fortinet_forticlient - 1.10.3 containing this change is available at https://epr.elastic.co/search?package=fortinet_forticlient

[elastic-vault-github-plugin-prod]

Package fortinet_fortiedr - 1.15.1 containing this change is available at https://epr.elastic.co/search?package=fortinet_fortiedr

[elastic-vault-github-plugin-prod]

Package fortinet_fortigate - 1.25.8 containing this change is available at https://epr.elastic.co/search?package=fortinet_fortigate

[elastic-vault-github-plugin-prod]

Package juniper_junos - 0.10.3 containing this change is available at https://epr.elastic.co/search?package=juniper_junos

[elastic-vault-github-plugin-prod]

Package juniper_netscreen - 0.10.3 containing this change is available at https://epr.elastic.co/search?package=juniper_netscreen

[elastic-vault-github-plugin-prod]

Package juniper_srx - 1.21.1 containing this change is available at https://epr.elastic.co/search?package=juniper_srx

[elastic-vault-github-plugin-prod]

Package modsecurity - 1.18.1 containing this change is available at https://epr.elastic.co/search?package=modsecurity

[elastic-vault-github-plugin-prod]

Package netflow - 2.19.1 containing this change is available at https://epr.elastic.co/search?package=netflow

[elastic-vault-github-plugin-prod]

Package netscout - 0.20.1 containing this change is available at https://epr.elastic.co/search?package=netscout

[elastic-vault-github-plugin-prod]

Package osquery - 1.19.1 containing this change is available at https://epr.elastic.co/search?package=osquery

[elastic-vault-github-plugin-prod]

Package pfsense - 1.20.1 containing this change is available at https://epr.elastic.co/search?package=pfsense

[elastic-vault-github-plugin-prod]

Package qnap_nas - 1.20.1 containing this change is available at https://epr.elastic.co/search?package=qnap_nas

[elastic-vault-github-plugin-prod]

Package radware - 0.19.1 containing this change is available at https://epr.elastic.co/search?package=radware

[elastic-vault-github-plugin-prod]

Package snort - 1.15.1 containing this change is available at https://epr.elastic.co/search?package=snort

[elastic-vault-github-plugin-prod]

Package sophos - 3.9.1 containing this change is available at https://epr.elastic.co/search?package=sophos

[elastic-vault-github-plugin-prod]

Package suricata - 2.21.3 containing this change is available at https://epr.elastic.co/search?package=suricata