Renderer: Add sanitize API (#50936)

* svg fun * #50597: add proto * #50597: add sanitizer methods * #50597: add provider * #50597: use sanitizer * #50597: use sanitizer * update grafana to match new api * add comments * add capability check * add timing * update sanitize path * improve log message * strings.HasPrefix rather than filepath.IsAbs * filepath.Clean + filepath.ToSlash for windows * read 404 * remove `path.clean` from `getPathAndScope` * add resp body close * remove unneeded prop * Update pkg/services/rendering/rendering.go Co-authored-by: Agnès Toulet <35176601+AgnesToulet@users.noreply.github.com> * remove test files * filepath.ToSlash correct wrapping * filepath.ToSlash correct wrapping * filepath.ToSlash comment * compilation error * lint fix * fix error message * Update pkg/services/rendering/rendering.go Co-authored-by: Agnès Toulet <35176601+AgnesToulet@users.noreply.github.com> * add `image/svg+xml` mime type * refactored log * refactored log Co-authored-by: Agnès Toulet <35176601+AgnesToulet@users.noreply.github.com>
2026-08-13 06:34:55 -05:00 · 2022-07-07 15:32:18 +04:00
parent f279699beb
commit e96f67ae2e
21 changed files with 710 additions and 28 deletions
@@ -16,6 +16,7 @@ type CapabilityName string
 const (
 	ScalingDownImages CapabilityName = "ScalingDownImages"
 	FullHeightImages  CapabilityName = "FullHeightImages"
+	SvgSanitization   CapabilityName = "SvgSanitization"
 )

 var ErrUnknownCapability = errors.New("unknown capability")
@@ -62,6 +62,15 @@ type ErrorOpts struct {
 	ErrorRenderUnavailable bool
 }

+type SanitizeSVGRequest struct {
+	Filename string
+	Content  []byte
+}
+
+type SanitizeSVGResponse struct {
+	Sanitized []byte
+}
+
 type CSVOpts struct {
 	TimeoutOpts
 	AuthOpts
@@ -83,6 +92,7 @@ type RenderCSVResult struct {

 type renderFunc func(ctx context.Context, renderKey string, options Opts) (*RenderResult, error)
 type renderCSVFunc func(ctx context.Context, renderKey string, options CSVOpts) (*RenderCSVResult, error)
+type sanitizeFunc func(ctx context.Context, req *SanitizeSVGRequest) (*SanitizeSVGResponse, error)

 type renderKeyProvider interface {
 	get(ctx context.Context, opts AuthOpts) (string, error)
@@ -114,4 +124,5 @@ type Service interface {
 	GetRenderUser(ctx context.Context, key string) (*RenderUser, bool)
 	HasCapability(capability CapabilityName) (CapabilitySupportRequestResult, error)
 	CreateRenderingSession(ctx context.Context, authOpts AuthOpts, sessionOpts SessionOpts) (Session, error)
+	SanitizeSVG(ctx context.Context, req *SanitizeSVGRequest) (*SanitizeSVGResponse, error)
 }
@@ -139,6 +139,21 @@ func (mr *MockServiceMockRecorder) RenderErrorImage(arg0, arg1 interface{}) *gom
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RenderErrorImage", reflect.TypeOf((*MockService)(nil).RenderErrorImage), arg0, arg1)
 }

+// SanitizeSVG mocks base method.
+func (m *MockService) SanitizeSVG(arg0 context.Context, arg1 *SanitizeSVGRequest) (*SanitizeSVGResponse, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SanitizeSVG", arg0, arg1)
+	ret0, _ := ret[0].(*SanitizeSVGResponse)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// SanitizeSVG indicates an expected call of SanitizeSVG.
+func (mr *MockServiceMockRecorder) SanitizeSVG(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SanitizeSVG", reflect.TypeOf((*MockService)(nil).SanitizeSVG), arg0, arg1)
+}
+
 // Version mocks base method.
 func (m *MockService) Version() string {
 	m.ctrl.T.Helper()
@@ -27,18 +27,22 @@ func init() {
 	remotecache.Register(&RenderUser{})
 }

+var _ Service = (*RenderingService)(nil)
+
 const ServiceName = "RenderingService"

 type RenderingService struct {
-	log             log.Logger
-	pluginInfo      *plugins.Plugin
-	renderAction    renderFunc
-	renderCSVAction renderCSVFunc
-	domain          string
-	inProgressCount int32
-	version         string
-	versionMutex    sync.RWMutex
-	capabilities    []Capability
+	log               log.Logger
+	pluginInfo        *plugins.Plugin
+	renderAction      renderFunc
+	renderCSVAction   renderCSVFunc
+	sanitizeSVGAction sanitizeFunc
+	sanitizeURL       string
+	domain            string
+	inProgressCount   int32
+	version           string
+	versionMutex      sync.RWMutex
+	capabilities      []Capability

 	perRequestRenderKeyProvider renderKeyProvider
 	Cfg                         *setting.Cfg
@@ -59,8 +63,14 @@ func ProvideService(cfg *setting.Cfg, remoteCache *remotecache.RemoteCache, rm p
 		return nil, fmt.Errorf("failed to create CSVs directory %q: %w", cfg.CSVsDir, err)
 	}

+	logger := log.New("rendering")
+
+	// URL for HTTP sanitize API
+	var sanitizeURL string
+
+	//  value used for domain attribute of renderKey cookie
 	var domain string
-	// set value used for domain attribute of renderKey cookie
+
 	switch {
 	case cfg.RendererUrl != "":
 		// RendererCallbackUrl has already been passed, it won't generate an error.
@@ -69,6 +79,7 @@ func ProvideService(cfg *setting.Cfg, remoteCache *remotecache.RemoteCache, rm p
 			return nil, err
 		}

+		sanitizeURL = getSanitizerURL(cfg.RendererUrl)
 		domain = u.Hostname()
 	case cfg.HTTPAddr != setting.DefaultHTTPAddr:
 		domain = cfg.HTTPAddr
@@ -76,7 +87,6 @@ func ProvideService(cfg *setting.Cfg, remoteCache *remotecache.RemoteCache, rm p
 		domain = "localhost"
 	}

-	logger := log.New("rendering")
 	s := &RenderingService{
 		perRequestRenderKeyProvider: &perRequestRenderKeyProvider{
 			cache:     remoteCache,
@@ -92,16 +102,26 @@ func ProvideService(cfg *setting.Cfg, remoteCache *remotecache.RemoteCache, rm p
 				name:             ScalingDownImages,
 				semverConstraint: ">= 3.4.0",
 			},
+			{
+				name:             SvgSanitization,
+				semverConstraint: ">= 3.5.0",
+			},
 		},
 		Cfg:                   cfg,
 		RemoteCacheService:    remoteCache,
 		RendererPluginManager: rm,
 		log:                   logger,
 		domain:                domain,
+		sanitizeURL:           sanitizeURL,
 	}
 	return s, nil
 }

+func getSanitizerURL(rendererURL string) string {
+	rendererBaseURL := strings.TrimSuffix(rendererURL, "/render")
+	return rendererBaseURL + "/sanitize"
+}
+
 func (rs *RenderingService) Run(ctx context.Context) error {
 	if rs.remoteAvailable() {
 		rs.log = rs.log.New("renderer", "http")
@@ -120,6 +140,7 @@ func (rs *RenderingService) Run(ctx context.Context) error {
 		})
 		rs.renderAction = rs.renderViaHTTP
 		rs.renderCSVAction = rs.renderCSVViaHTTP
+		rs.sanitizeSVGAction = rs.sanitizeViaHTTP

 		refreshTicker := time.NewTicker(remoteVersionRefreshInterval)

@@ -146,6 +167,7 @@ func (rs *RenderingService) Run(ctx context.Context) error {
 		rs.version = rs.pluginInfo.Info.Version
 		rs.renderAction = rs.renderViaPlugin
 		rs.renderCSVAction = rs.renderCSVViaPlugin
+		rs.sanitizeSVGAction = rs.sanitizeSVGViaPlugin
 		<-ctx.Done()

 		// On Windows, Chromium is generating a debug.log file that breaks signature check on next restart
@@ -293,6 +315,26 @@ func (rs *RenderingService) RenderCSV(ctx context.Context, opts CSVOpts, session
 	return result, err
 }

+func (rs *RenderingService) SanitizeSVG(ctx context.Context, req *SanitizeSVGRequest) (*SanitizeSVGResponse, error) {
+	capability, err := rs.HasCapability(SvgSanitization)
+	if err != nil {
+		return nil, err
+	}
+
+	if !capability.IsSupported {
+		return nil, fmt.Errorf("svg sanitization unsupported, requires image renderer version: %s", capability.SemverConstraint)
+	}
+
+	start := time.Now()
+
+	action, err := rs.sanitizeSVGAction(ctx, req)
+	if err != nil {
+		defer rs.log.Info("svg sanitization finished", "duration", time.Since(start), "filename", req.Filename, "isError", err != nil)
+	}
+
+	return action, err
+}
+
 func (rs *RenderingService) renderCSV(ctx context.Context, opts CSVOpts, renderKeyProvider renderKeyProvider) (*RenderCSVResult, error) {
 	if int(atomic.LoadInt32(&rs.inProgressCount)) > opts.ConcurrentLimit {
 		return nil, ErrConcurrentLimitReached
@@ -0,0 +1,178 @@
+package rendering
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/textproto"
+	"net/url"
+	"time"
+
+	"github.com/grafana/grafana/pkg/plugins/backendplugin/pluginextensionv2"
+)
+
+var (
+	domPurifySvgConfig = map[string]interface{}{
+		// domPurifyConfig is passed directly to DOMPurify https://github.com/cure53/DOMPurify#can-i-configure-dompurify
+		"domPurifyConfig": map[string]interface{}{
+			"USE_PROFILES": map[string]bool{"svg": true, "svgFilters": true},
+			"ADD_TAGS":     []string{"use"},
+		},
+		// allowAllLinksInSvgUseTags will preserve all `use` tags.
+		// By default, we remove all non-self-referential `use` tags, i.e. those which `href` attribute does not start with `#`
+		"allowAllLinksInSvgUseTags": false,
+	}
+	domPurifyConfigType = "DOMPurify"
+)
+
+type formFile struct {
+	fileName    string
+	key         string
+	contentType string
+	content     io.Reader
+}
+
+func createMultipartRequestBody(values []formFile) (bytes.Buffer, string, error) {
+	var b bytes.Buffer
+	w := multipart.NewWriter(&b)
+	for _, f := range values {
+		h := make(textproto.MIMEHeader)
+		h.Set("Content-Disposition", fmt.Sprintf(`form-data; name="%s"; filename="%s"`, f.key, f.fileName))
+		h.Set("Content-Type", f.contentType)
+		formWriter, err := w.CreatePart(h)
+
+		if err != nil {
+			return bytes.Buffer{}, "", err
+		}
+
+		if _, err := io.Copy(formWriter, f.content); err != nil {
+			return bytes.Buffer{}, "", err
+		}
+
+		if x, ok := f.content.(io.Closer); ok {
+			_ = x.Close()
+		}
+	}
+
+	if err := w.Close(); err != nil {
+		return bytes.Buffer{}, "", err
+	}
+
+	return b, w.FormDataContentType(), nil
+}
+
+func (rs *RenderingService) sanitizeViaHTTP(ctx context.Context, req *SanitizeSVGRequest) (*SanitizeSVGResponse, error) {
+	sanitizerUrl, err := url.Parse(rs.sanitizeURL)
+	if err != nil {
+		return nil, err
+	}
+
+	configJson, err := json.Marshal(map[string]interface{}{
+		"config":     domPurifySvgConfig,
+		"configType": domPurifyConfigType,
+	})
+	if err != nil {
+		rs.log.Error("Sanitizer - HTTP: failed to create the request config", "error", err, "filename", req.Filename)
+		return nil, fmt.Errorf("config creation fail: %s", err)
+	}
+
+	body, contentType, err := createMultipartRequestBody([]formFile{
+		{
+			fileName:    "config",
+			key:         "config",
+			contentType: "application/json",
+			content:     bytes.NewReader(configJson),
+		},
+		{
+			fileName:    req.Filename,
+			key:         "file",
+			contentType: "image/svg+xml",
+			content:     bytes.NewReader(req.Content),
+		},
+	})
+	if err != nil {
+		rs.log.Error("Sanitizer - HTTP: failed to create the request body", "error", err, "filename", req.Filename)
+		return nil, fmt.Errorf("body creation fail: %s", err)
+	}
+
+	reqContext, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	httpReq, err := http.NewRequestWithContext(reqContext, "POST", sanitizerUrl.String(), &body)
+	if err != nil {
+		rs.log.Error("Sanitizer - HTTP: failed to create the HTTP request", "error", err, "filename", req.Filename)
+		return nil, err
+	}
+
+	httpReq.Header.Set("User-Agent", fmt.Sprintf("Grafana/%s", rs.Cfg.BuildVersion))
+	httpReq.Header.Set("Content-Type", contentType)
+
+	rs.log.Debug("Sanitizer - HTTP: calling", "filename", req.Filename, "contentLength", len(req.Content), "url", sanitizerUrl)
+	// make request to renderer server
+	resp, err := netClient.Do(httpReq)
+	if err != nil {
+		rs.log.Error("Sanitizer - HTTP: failed to send request", "error", err)
+		return nil, fmt.Errorf("sanitizer - HTTP: failed to send request: %w", err)
+	}
+
+	defer func() {
+		if err := resp.Body.Close(); err != nil {
+			rs.log.Error("Sanitizer - HTTP: failed to close response body", "statusCode", resp.StatusCode, "error", err)
+		}
+	}()
+
+	if resp.StatusCode != http.StatusOK {
+		if body, err := io.ReadAll(resp.Body); body != nil {
+			rs.log.Error("Sanitizer - HTTP: failed to sanitize", "statusCode", resp.StatusCode, "error", err, "resp", string(body))
+		} else {
+			rs.log.Error("Sanitizer - HTTP: failed to sanitize", "statusCode", resp.StatusCode, "error", err)
+		}
+		return nil, fmt.Errorf("sanitizer - HTTP: failed to sanitize %s", req.Filename)
+	}
+
+	sanitized, err := io.ReadAll(resp.Body)
+	if err != nil {
+		rs.log.Error("Sanitizer - HTTP: failed to read response body", "error", err, "filename", req.Filename)
+		return nil, fmt.Errorf("sanitizer - HTTP: failed to read response body: %s", err)
+	}
+
+	return &SanitizeSVGResponse{Sanitized: sanitized}, nil
+}
+
+func (rs *RenderingService) sanitizeSVGViaPlugin(ctx context.Context, req *SanitizeSVGRequest) (*SanitizeSVGResponse, error) {
+	ctx, cancel := context.WithTimeout(ctx, time.Second*20)
+	defer cancel()
+
+	domPurifyConfig, err := json.Marshal(domPurifySvgConfig)
+	if err != nil {
+		rs.log.Error("Sanitizer - plugin: failed to parse domPurifyConfig")
+		return nil, fmt.Errorf("sanitizer - plugin: failed to parse domPurifyConfig %s", err)
+	}
+	grpcReq := &pluginextensionv2.SanitizeRequest{
+		Filename:   req.Filename,
+		Content:    req.Content,
+		ConfigType: domPurifyConfigType,
+		Config:     domPurifyConfig,
+	}
+	rs.log.Debug("Sanitizer - plugin: calling", "filename", req.Filename, "contentLength", len(req.Content))
+
+	rsp, err := rs.pluginInfo.Renderer.Sanitize(ctx, grpcReq)
+	if err != nil {
+		if errors.Is(ctx.Err(), context.DeadlineExceeded) {
+			rs.log.Info("Sanitizer - plugin: time out")
+			return nil, ErrTimeout
+		}
+
+		return nil, err
+	}
+
+	if rsp.Error != "" {
+		return nil, fmt.Errorf("sanitizer - plugin: failed to sanitize: %s", rsp.Error)
+	}
+
+	return &SanitizeSVGResponse{Sanitized: rsp.Sanitized}, nil
+}