public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[v10.3.x] Elasticsearch: Fix URL creation and allowlist for /_mapping requests (#81057)

Browse Source 
Elasticsearch: Fix URL creation and allowlist for `/_mapping` requests (#80970)

* Elasticsearch: Fix URL creation for mapping requests

* remove leading slash by default

* add comment for es route

* hardcode `_mapping`

* update doc

(cherry picked from commit 3d033839d7)

Co-authored-by: Sven Grossmann <sven.grossmann@grafana.com>
This commit is contained in:
grafana-delivery-bot[bot]
2024-01-23 13:15:58 +01:00
committed by GitHub
co-authored by Sven Grossmann
parent b55cd1288c
commit 0177550993
4 changed files with 26 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/tsdb/elasticsearch/elasticsearch.go
+3 -2
View File
@@ -188,9 +188,10 @@ func (s *Service) CallResource(ctx context.Context, req *backend.CallResourceReq
logger := eslog.FromContext(ctx)
// allowed paths for resource calls:
// - empty string for fetching db version
// - ?/_mapping for fetching index mapping
// - /_mapping for fetching index mapping, e.g. requests going to `index/_mapping`
// - _msearch for executing getTerms queries
if req.Path != "" && !strings.HasSuffix(req.Path, "/_mapping") && req.Path != "_msearch" {
// - _mapping for fetching "root" index mappings
if req.Path != "" && !strings.HasSuffix(req.Path, "/_mapping") && req.Path != "_msearch" && req.Path != "_mapping" {
logger.Error("Invalid resource path", "path", req.Path)
return fmt.Errorf("invalid resource URL: %s", req.Path)
}