[v11.1.x] ServerSideExpressions: Disable SQL Expressions to prevent RCE and LFI vulnerability (#94969)
* remove sql expressions - backport 11.1.x * Run `make gen-go` and `go mod tidy` --------- Co-authored-by: Scott Lepper <scott.lepper@gmail.com>
This commit is contained in:
@@ -7,7 +7,6 @@ import (
|
||||
"time"
|
||||
|
||||
"github.com/grafana/grafana-plugin-sdk-go/data"
|
||||
"github.com/scottlepp/go-duck/duck"
|
||||
|
||||
"github.com/grafana/grafana/pkg/expr/mathexp"
|
||||
"github.com/grafana/grafana/pkg/expr/sql"
|
||||
@@ -94,7 +93,7 @@ func (gr *SQLCommand) Execute(ctx context.Context, now time.Time, vars mathexp.V
|
||||
|
||||
rsp := mathexp.Results{}
|
||||
|
||||
duckDB := duck.NewInMemoryDB()
|
||||
duckDB := sql.NewInMemoryDB()
|
||||
var frame = &data.Frame{}
|
||||
|
||||
logger.Debug("Executing query", "query", gr.query, "frames", len(allFrames))
|
||||
|
||||
Reference in New Issue
Block a user