fix(threat-intel): resolve list_sources URLs from the code catalog

After elastic#287201, feed URLs are no longer stored on source documents.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: stephmilovic

x-pack/solutions/security/plugins/security_solution/server/threat_intel/routes/list_sources.test.ts

@@ -154,40 +154,22 @@ describe('loadSourceReportStatsByAdapterId', () => {
 // ── Credential exposure ──────────────────────────────────────────────────────
 
 describe('mapSourceHit', () => {
-  // This route is gated on Security Read and lists global sources in every space,
-  // so returning the raw config URL handed feed credentials to anyone who could
-  // read the catalog.
-  it('redacts credentials from the returned URL', () => {
+  it('returns the catalog URL for a known source id', () => {
     const mapped = mapSourceHitForTest({
-      _id: 'default:rss:acme',
+      _id: 'vendor_api:elastic-security-labs',
       _source: {
-        name: 'Acme',
+        name: 'Elastic Security Labs',
         adapter_type: 'rss',
-        config: { url: 'https://feeduser:s3cret@feeds.example/rss.xml' },
       },
     });
 
-    expect(mapped.url).toBe('https://feeds.example/rss.xml');
-    expect(JSON.stringify(mapped)).not.toContain('s3cret');
+    expect(mapped.url).toBe('https://www.elastic.co/security-labs/rss/feed.xml');
   });
 
-  it('leaves a credential-free URL alone', () => {
+  it('omits the url when the source id is outside the catalog', () => {
     const mapped = mapSourceHitForTest({
-      _id: 'default:rss:acme',
-      _source: {
-        name: 'Acme',
-        adapter_type: 'rss',
-        config: { url: 'https://feeds.example/rss.xml' },
-      },
-    });
-
-    expect(mapped.url).toBe('https://feeds.example/rss.xml');
-  });
-
-  it('omits the url when the source has none', () => {
-    const mapped = mapSourceHitForTest({
-      _id: 'default:kev:cisa',
-      _source: { name: 'CISA', adapter_type: 'kev', config: {} },
+      _id: 'rss:unknown',
+      _source: { name: 'Acme', adapter_type: 'rss' },
     });
 
     expect(mapped.url).toBeUndefined();
@@ -197,7 +179,7 @@ describe('mapSourceHit', () => {
 describe('loadSourceForMutation', () => {
   const globalSource = (spaceId?: string) => ({
     get: jest.fn().mockResolvedValue({
-      _source: { name: 'Acme', adapter_type: 'rss', config: {}, space_id: spaceId },
+      _source: { name: 'Acme', adapter_type: 'rss', space_id: spaceId },
     }),
   });
 

x-pack/solutions/security/plugins/security_solution/server/threat_intel/routes/list_sources.ts

@@ -13,6 +13,7 @@ import {
   THREAT_INTEL_SOURCES_INDEX,
   THREAT_REPORTS_INDEX_PATTERN,
   APPROVED_SOURCE_IDS,
+  resolveCatalogSourceUrl,
 } from '../../../common/threat_intel';
 import {
   buildSpaceFilterTerms,
@@ -40,7 +41,6 @@ interface ThreatIntelSourceDoc {
   name?: string;
   adapter_type?: string;
   enabled?: boolean;
-  config?: { url?: unknown };
   tags?: string[];
   created_at?: string;
   updated_at?: string;
@@ -76,18 +76,17 @@ const mapSourceHit = (hit: {
   _source?: ThreatIntelSourceDoc;
 }): Omit<ListSourcesItem, 'report_count' | 'last_ingested_at' | 'env_hits_total'> => {
   const source = hit._source ?? {};
-  // Redacted for display. Feed URLs can embed `user:password@`, and this route is
-  // gated on Security Read and lists global sources in every space, so returning
-  // the raw value handed feed credentials to anyone who could read the catalog.
-  // The stored document keeps the real URL for the adapter to fetch with.
-  const configUrl =
-    typeof source.config?.url === 'string' ? redactUrl(source.config.url) : undefined;
+  const sourceId = hit._id ?? '';
+  // URLs come from the code catalog, not Elasticsearch. Redact userinfo before
+  // returning a URL to Security Read callers listing global sources in every space.
+  const catalogUrl = resolveCatalogSourceUrl(sourceId);
+  const displayUrl = typeof catalogUrl === 'string' ? redactUrl(catalogUrl) : undefined;
   return {
-    source_id: hit._id ?? '',
+    source_id: sourceId,
     name: source.name,
     adapter_type: source.adapter_type,
     enabled: source.enabled,
-    ...(typeof configUrl === 'string' ? { url: configUrl } : {}),
+    ...(typeof displayUrl === 'string' ? { url: displayUrl } : {}),
     tags: source.tags,
     created_at: source.created_at,
     updated_at: source.updated_at,