grafana/pkg/api/plugin_resource.go
Giedrius Statkevičius 6f245121d0
Plugins: Fix colon in CallResource URL returning an error when creating plugin resource request (#79746)
* Plugin: handle colon character in path

url.Parse() does not handle the given input correctly when the input
contains a colon character. The user will see the following error
message when trying to use remote cluster in Elasticsearch:

```
level=warn msg="Failed for create plugin resource request" error="parse \"foo-*,*:foo-*/_mapping\": first path segment in URL cannot contain colon" traceID=
```

As far as I can tell, we only want to set the path here + rawquery so
avoid url.Parse() altogether.

* Add more tests

---------

Co-authored-by: Giuseppe Guerra <giuseppe@guerra.in>
2024-01-29 10:31:49 +01:00

127 lines
3.6 KiB
Go

package api
import (
"errors"
"fmt"
"io"
"net/http"
"net/url"
"github.com/grafana/grafana-plugin-sdk-go/backend"
"github.com/grafana/grafana/pkg/api/response"
"github.com/grafana/grafana/pkg/middleware/requestmeta"
"github.com/grafana/grafana/pkg/plugins"
"github.com/grafana/grafana/pkg/plugins/httpresponsesender"
contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
"github.com/grafana/grafana/pkg/services/datasources"
"github.com/grafana/grafana/pkg/util/proxyutil"
"github.com/grafana/grafana/pkg/web"
)
// CallResource passes a resource call from a plugin to the backend plugin.
//
// /api/plugins/:pluginId/resources/*
func (hs *HTTPServer) CallResource(c *contextmodel.ReqContext) {
hs.callPluginResource(c, web.Params(c.Req)[":pluginId"])
}
func (hs *HTTPServer) callPluginResource(c *contextmodel.ReqContext, pluginID string) {
pCtx, err := hs.pluginContextProvider.Get(c.Req.Context(), pluginID, c.SignedInUser, c.SignedInUser.GetOrgID())
if err != nil {
if errors.Is(err, plugins.ErrPluginNotRegistered) {
c.JsonApiErr(404, "Plugin not found", nil)
return
}
c.JsonApiErr(500, "Failed to get plugin settings", err)
return
}
req, err := hs.pluginResourceRequest(c)
if err != nil {
c.JsonApiErr(http.StatusBadRequest, "Failed for create plugin resource request", err)
return
}
if err = hs.makePluginResourceRequest(c.Resp, req, pCtx); err != nil {
handleCallResourceError(err, c)
return
}
requestmeta.WithStatusSource(c.Req.Context(), c.Resp.Status())
}
func (hs *HTTPServer) callPluginResourceWithDataSource(c *contextmodel.ReqContext, pluginID string, ds *datasources.DataSource) {
pCtx, err := hs.pluginContextProvider.GetWithDataSource(c.Req.Context(), pluginID, c.SignedInUser, ds)
if err != nil {
if errors.Is(err, plugins.ErrPluginNotRegistered) {
c.JsonApiErr(404, "Plugin not found", nil)
return
}
c.JsonApiErr(500, "Failed to get plugin settings", err)
return
}
var dsURL string
if pCtx.DataSourceInstanceSettings != nil {
dsURL = pCtx.DataSourceInstanceSettings.URL
}
err = hs.PluginRequestValidator.Validate(dsURL, c.Req)
if err != nil {
c.JsonApiErr(http.StatusForbidden, "Access denied", err)
return
}
req, err := hs.pluginResourceRequest(c)
if err != nil {
c.JsonApiErr(http.StatusBadRequest, "Failed for create plugin resource request", err)
return
}
if err = hs.makePluginResourceRequest(c.Resp, req, pCtx); err != nil {
handleCallResourceError(err, c)
return
}
requestmeta.WithStatusSource(c.Req.Context(), c.Resp.Status())
}
func (hs *HTTPServer) pluginResourceRequest(c *contextmodel.ReqContext) (*http.Request, error) {
clonedReq := c.Req.Clone(c.Req.Context())
rawURL := web.Params(c.Req)["*"]
clonedReq.URL = &url.URL{
Path: rawURL,
RawQuery: clonedReq.URL.RawQuery,
}
return clonedReq, nil
}
func (hs *HTTPServer) makePluginResourceRequest(w http.ResponseWriter, req *http.Request, pCtx backend.PluginContext) error {
proxyutil.PrepareProxyRequest(req)
body, err := io.ReadAll(req.Body)
if err != nil {
return fmt.Errorf("failed to read request body: %w", err)
}
crReq := &backend.CallResourceRequest{
PluginContext: pCtx,
Path: req.URL.Path,
Method: req.Method,
URL: req.URL.String(),
Headers: req.Header,
Body: body,
}
httpSender := httpresponsesender.New(w)
return hs.pluginClient.CallResource(req.Context(), crReq, httpSender)
}
func handleCallResourceError(err error, reqCtx *contextmodel.ReqContext) {
resp := response.ErrOrFallback(http.StatusInternalServerError, "Failed to call resource", err)
resp.WriteTo(reqCtx)
}