live: add allowed_origins option (#36318)

pkg/services/live/live.go

@@ -10,6 +10,8 @@ import (
 	"sync"
 	"time"
 
+	"github.com/gobwas/glob"
+
 	"github.com/grafana/grafana/pkg/api/dtos"
 	"github.com/grafana/grafana/pkg/api/response"
 	"github.com/grafana/grafana/pkg/api/routing"
@@ -318,21 +320,21 @@ func (g *GrafanaLive) Init() error {
 		return fmt.Errorf("error parsing AppURL %s: %w", g.Cfg.AppURL, err)
 	}
 
+	originPatterns := g.Cfg.LiveAllowedOrigins
+	originGlobs, _ := setting.GetAllowedOriginGlobs(originPatterns) // error already checked on config load.
+	checkOrigin := getCheckOriginFunc(appURL, originPatterns, originGlobs)
+
 	// Use a pure websocket transport.
 	wsHandler := centrifuge.NewWebsocketHandler(node, centrifuge.WebsocketConfig{
 		ReadBufferSize:  1024,
 		WriteBufferSize: 1024,
-		CheckOrigin: func(r *http.Request) bool {
-			return checkOrigin(r, appURL)
-		},
+		CheckOrigin:     checkOrigin,
 	})
 
 	pushWSHandler := pushws.NewHandler(g.ManagedStreamRunner, pushws.Config{
 		ReadBufferSize:  1024,
 		WriteBufferSize: 1024,
-		CheckOrigin: func(r *http.Request) bool {
-			return checkOrigin(r, appURL)
-		},
+		CheckOrigin:     checkOrigin,
 	})
 
 	g.websocketHandler = func(ctx *models.ReqContext) {
@@ -371,21 +373,44 @@ func (g *GrafanaLive) Init() error {
 	return nil
 }
 
-func checkOrigin(r *http.Request, appURL *url.URL) bool {
-	origin := r.Header.Get("Origin")
-	if origin == "" {
+func getCheckOriginFunc(appURL *url.URL, originPatterns []string, originGlobs []glob.Glob) func(r *http.Request) bool {
+	return func(r *http.Request) bool {
+		origin := r.Header.Get("Origin")
+		if origin == "" {
+			return true
+		}
+		if len(originPatterns) == 1 && originPatterns[0] == "*" {
+			// fast path for *.
+			return true
+		}
+		ok, err := checkAllowedOrigin(strings.ToLower(origin), appURL, originGlobs)
+		if err != nil {
+			logger.Warn("Error parsing request origin", "error", err, "origin", origin)
+			return false
+		}
+		if !ok {
+			logger.Warn("Request Origin is not authorized", "origin", origin, "appUrl", appURL.String(), "allowedOrigins", strings.Join(originPatterns, ","))
+			return false
+		}
 		return true
 	}
+}
+
+func checkAllowedOrigin(origin string, appURL *url.URL, originGlobs []glob.Glob) (bool, error) {
 	originURL, err := url.Parse(origin)
 	if err != nil {
 		logger.Warn("Failed to parse request origin", "error", err, "origin", origin)
-		return false
+		return false, err
 	}
-	if !strings.EqualFold(originURL.Scheme, appURL.Scheme) || !strings.EqualFold(originURL.Host, appURL.Host) {
-		logger.Warn("Request Origin is not authorized", "origin", origin, "appUrl", appURL.String())
-		return false
+	if strings.EqualFold(originURL.Scheme, appURL.Scheme) && strings.EqualFold(originURL.Host, appURL.Host) {
+		return true, nil
 	}
-	return true
+	for _, pattern := range originGlobs {
+		if pattern.Match(origin) {
+			return true, nil
+		}
+	}
+	return false, nil
 }
 
 func runConcurrentlyIfNeeded(ctx context.Context, semaphore chan struct{}, fn func()) error {

pkg/services/live/live_test.go

@@ -7,6 +7,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/grafana/grafana/pkg/setting"
+
 	"github.com/stretchr/testify/require"
 )
 
@@ -55,10 +57,11 @@ func Test_runConcurrentlyIfNeeded_DeadlineExceeded(t *testing.T) {
 
 func TestCheckOrigin(t *testing.T) {
 	testCases := []struct {
-		name    string
-		origin  string
-		appURL  string
-		success bool
+		name           string
+		origin         string
+		appURL         string
+		allowedOrigins []string
+		success        bool
 	}{
 		{
 			name:    "empty_origin",
@@ -96,6 +99,27 @@ func TestCheckOrigin(t *testing.T) {
 			appURL:  "https://example.com",
 			success: true,
 		},
+		{
+			name:           "authorized_allowed_origins",
+			origin:         "https://test.example.com",
+			appURL:         "http://localhost:3000/",
+			allowedOrigins: []string{"https://test.example.com"},
+			success:        true,
+		},
+		{
+			name:           "authorized_allowed_origins_pattern",
+			origin:         "https://test.example.com",
+			appURL:         "http://localhost:3000/",
+			allowedOrigins: []string{"https://*.example.com"},
+			success:        true,
+		},
+		{
+			name:           "authorized_allowed_origins_all",
+			origin:         "https://test.example.com",
+			appURL:         "http://localhost:3000/",
+			allowedOrigins: []string{"*"},
+			success:        true,
+		},
 	}
 
 	for _, tc := range testCases {
@@ -104,9 +128,15 @@ func TestCheckOrigin(t *testing.T) {
 			t.Parallel()
 			appURL, err := url.Parse(tc.appURL)
 			require.NoError(t, err)
+
+			originGlobs, err := setting.GetAllowedOriginGlobs(tc.allowedOrigins)
+			require.NoError(t, err)
+
+			checkOrigin := getCheckOriginFunc(appURL, tc.allowedOrigins, originGlobs)
+
 			r := httptest.NewRequest("GET", tc.appURL, nil)
 			r.Header.Set("Origin", tc.origin)
-			require.Equal(t, tc.success, checkOrigin(r, appURL),
+			require.Equal(t, tc.success, checkOrigin(r),
 				"origin %s, appURL: %s", tc.origin, tc.appURL,
 			)
 		})