IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

fixes

Browse Source 
(cherry picked from commit a2c386915ce11b9422f4af8ae181eaa1a22bc5c3)
This commit is contained in:
Will Browne 2021-12-09 17:47:51 +00:00 committed by Marcus Efraimsson
parent 7183b01df1
commit 06706efbbe
No known key found for this signature in database
GPG Key ID: EBFE0FB04612DD4A
2 changed files with 13 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
pkg/api/plugins.go
View File

@ -478,15 +478,15 @@ func (hs *HTTPServer) pluginMarkdown(ctx context.Context, pluginId string, name
} }
// nolint:gosec // nolint:gosec
// We can ignore the gosec G304 warning on this one because `plugin.PluginDir` is based // We can ignore the gosec G304 warning since we have cleaned the requested file path and subsequently
// on plugin the folder structure on disk and not user input. // use this with a prefix of the plugin's directory, which is set during plugin loading
path := filepath.Join(plugin.PluginDir, fmt.Sprintf("%s.md", strings.ToUpper(name))) path := filepath.Join(plugin.PluginDir, mdFilepath(strings.ToUpper(name)))
exists, err := fs.Exists(path) exists, err := fs.Exists(path)
if err != nil { if err != nil {
return nil, err return nil, err
} }
if !exists { if !exists {
path = filepath.Join(plugin.PluginDir, fmt.Sprintf("%s.md", strings.ToLower(name))) path = filepath.Join(plugin.PluginDir, mdFilepath( strings.ToLower(name)))
} }
exists, err = fs.Exists(path) exists, err = fs.Exists(path)
@ -498,11 +498,15 @@ func (hs *HTTPServer) pluginMarkdown(ctx context.Context, pluginId string, name
} }
// nolint:gosec // nolint:gosec
// We can ignore the gosec G304 warning on this one because `plugin.PluginDir` is based // We can ignore the gosec G304 warning since we have cleaned the requested file path and subsequently
// on plugin the folder structure on disk and not user input. // use this with a prefix of the plugin's directory, which is set during plugin loading
data, err := ioutil.ReadFile(path) data, err := ioutil.ReadFile(path)
if err != nil { if err != nil {
return nil, err return nil, err
} }
return data, nil return data, nil
} }
func mdFilepath(mdFilename string) string {
return filepath.Clean(filepath.Join("/", fmt.Sprintf("%s.md", mdFilename)))
}

8
pkg/tsdb/testdatasource/csv_data.go
View File

@ -8,7 +8,6 @@ import (
"io" "io"
"os" "os"
"path/filepath" "path/filepath"
"regexp"
"strconv" "strconv"
"strings" "strings"
"time" "time"
@ -73,13 +72,12 @@ func (s *Service) handleCsvFileScenario(ctx context.Context, req *backend.QueryD
} }
func (s *Service) loadCsvFile(fileName string) (*data.Frame, error) { func (s *Service) loadCsvFile(fileName string) (*data.Frame, error) {
validFileName := regexp.MustCompile(`([\w_]+)\.csv`) if filepath.Ext(fileName) != ".csv" || strings.Contains(fileName, "..") {
if !validFileName.MatchString(fileName) {
return nil, fmt.Errorf("invalid csv file name: %q", fileName) return nil, fmt.Errorf("invalid csv file name: %q", fileName)
} }
filePath := filepath.Join(s.cfg.StaticRootPath, "testdata", fileName) csvFilepath := filepath.Clean(filepath.Join("/", fileName))
filePath := filepath.Join(s.cfg.StaticRootPath, "testdata", csvFilepath)
// Can ignore gosec G304 here, because we check the file pattern above // Can ignore gosec G304 here, because we check the file pattern above
// nolint:gosec // nolint:gosec