Chore: Remove sensitive information from presigned URLs prior to logging (#87035)

Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>
Co-authored-by: Dan Cech <dcech@grafana.com>
Co-authored-by: Andres Martinez Gotor <andres.martinez@grafana.com>

pkg/middleware/loggermw/logger.go

@@ -19,11 +19,11 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
-	"net/url"
 	"time"
 
 	"github.com/grafana/grafana/pkg/middleware"
 	"github.com/grafana/grafana/pkg/middleware/requestmeta"
+	"github.com/grafana/grafana/pkg/util"
 
 	"github.com/grafana/grafana/pkg/apimachinery/errutil"
 
@@ -113,7 +113,7 @@ func (l *loggerImpl) prepareLogParams(c *contextmodel.ReqContext, duration time.
 		"size", rw.Size(),
 	}
 
-	referer, err := SanitizeURL(r.Referer())
+	referer, err := util.SanitizeURI(r.Referer())
 	// We add an empty referer when there's a parsing error, hence this is before the err check.
 	logParams = append(logParams, "referer", referer)
 	if err != nil {
@@ -153,27 +153,3 @@ func errorLogParams(err error) []any {
 		"error", gfErr.LogMessage,
 	}
 }
-
-var sensitiveQueryStrings = [...]string{
-	"auth_token",
-}
-
-func SanitizeURL(s string) (string, error) {
-	if s == "" {
-		return s, nil
-	}
-
-	u, err := url.ParseRequestURI(s)
-	if err != nil {
-		return "", fmt.Errorf("failed to sanitize URL")
-	}
-
-	// strip out sensitive query strings
-	values := u.Query()
-	for _, query := range sensitiveQueryStrings {
-		values.Del(query)
-	}
-	u.RawQuery = values.Encode()
-
-	return u.String(), nil
-}

pkg/middleware/loggermw/logger_test.go

@@ -16,43 +16,6 @@ import (
 	"github.com/grafana/grafana/pkg/web"
 )
 
-func Test_sanitizeURL(t *testing.T) {
-	tests := []struct {
-		name        string
-		input       string
-		want        string
-		expectError bool
-	}{
-		{
-			name:  "Receiving empty string should return it",
-			input: "",
-			want:  "",
-		},
-		{
-			name:  "Receiving valid URL string should return it parsed",
-			input: "https://grafana.com/",
-			want:  "https://grafana.com/",
-		},
-		{
-			name:        "Receiving invalid URL string should return empty string",
-			input:       "this is not a valid URL",
-			want:        "",
-			expectError: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			url, err := SanitizeURL(tt.input)
-			if tt.expectError {
-				assert.Error(t, err)
-			} else {
-				assert.NoError(t, err)
-			}
-			assert.Equalf(t, tt.want, url, "SanitizeURL(%v)", tt.input)
-		})
-	}
-}
-
 func Test_prepareLog(t *testing.T) {
 	type opts struct {
 		Features      []any