IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2026-08-11 13:44:59 -05:00
Code Issues Packages Projects Releases Wiki Activity

Plugins: Requests validator (#30445)

Browse Source 
* Introduce PluginRequestValidator abstraction with a NoOp implementation

* Update PluginRequestValidator abstraction to use the dsURL instead

* Inject PluginRequestValidator into the HTTPServer and validate requests going through data source proxy

* Inject PluginRequestValidator into the BackendPluginManager and validate requests going through it

* Validate requests going through QueryMetrics & QueryMetricsV2

* Validate BackendPluginManager health requests

* Fix backend plugins manager tests

* Validate requests going through alerting service

* Fix tests

* fix tests

* goimports

Co-authored-by: Leonard Gram <leo@xlson.com>
This commit is contained in:
Joan López de la Franca Beltran
2021-02-03 20:47:45 +01:00
committed by GitHub
co-authored by Leonard Gram
parent 4a324e3d74
commit 6415d2802e
26 changed files with 224 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/dataproxy.go
+12 -5
View File
@@ -3,6 +3,7 @@ package api
import (
"errors"
"fmt"
"net/http"
"github.com/grafana/grafana/pkg/api/datasource"
"github.com/grafana/grafana/pkg/api/pluginproxy"
@@ -19,17 +20,23 @@ func (hs *HTTPServer) ProxyDataSourceRequest(c *models.ReqContext) {
ds, err := hs.DatasourceCache.GetDatasource(dsID, c.SignedInUser, c.SkipCache)
if err != nil {
if errors.Is(err, models.ErrDataSourceAccessDenied) {
c.JsonApiErr(403, "Access denied to datasource", err)
c.JsonApiErr(http.StatusForbidden, "Access denied to datasource", err)
return
}
c.JsonApiErr(500, "Unable to load datasource meta data", err)
c.JsonApiErr(http.StatusInternalServerError, "Unable to load datasource meta data", err)
return
}
err = hs.PluginRequestValidator.Validate(ds.Url, c.Req.Request)
if err != nil {
c.JsonApiErr(http.StatusForbidden, "Access denied", err)
return
}
// find plugin
plugin, ok := plugins.DataSources[ds.Type]
if !ok {
c.JsonApiErr(500, "Unable to find datasource plugin", err)
c.JsonApiErr(http.StatusInternalServerError, "Unable to find datasource plugin", err)
return
}
@@ -39,9 +46,9 @@ func (hs *HTTPServer) ProxyDataSourceRequest(c *models.ReqContext) {
proxy, err := pluginproxy.NewDataSourceProxy(ds, plugin, c, proxyPath, hs.Cfg)
if err != nil {
if errors.Is(err, datasource.URLValidationError{}) {
c.JsonApiErr(400, fmt.Sprintf("Invalid data source URL: %q", ds.Url), err)
c.JsonApiErr(http.StatusBadRequest, fmt.Sprintf("Invalid data source URL: %q", ds.Url), err)
} else {
c.JsonApiErr(500, "Failed creating data source proxy", err)
c.JsonApiErr(http.StatusInternalServerError, "Failed creating data source proxy", err)
}
return
}