From 157435a61c955c1675f0fbd21a2a246c8161d9a2 Mon Sep 17 00:00:00 2001
From: Nozomi Anzai <anzai@sraoss.co.jp>
Date: Wed, 17 Aug 2016 14:33:59 +0900
Subject: [PATCH] Fix to check white list when the frontend tries to connect DB

---
 pkg/api/dataproxy.go | 36 +++++++++++++++++++++++++-----------
 1 file changed, 25 insertions(+), 11 deletions(-)

diff --git a/pkg/api/dataproxy.go b/pkg/api/dataproxy.go
index e51c54d54ab..c15385e7017 100644
--- a/pkg/api/dataproxy.go
+++ b/pkg/api/dataproxy.go
@@ -91,21 +91,24 @@ func ProxyDataSourceRequest(c *middleware.Context) {
 		return
 	}
 
-	targetUrl, _ := url.Parse(ds.Url)
-	if len(setting.DataProxyWhiteList) > 0 {
-		if _, exists := setting.DataProxyWhiteList[targetUrl.Host]; !exists {
-			c.JsonApiErr(403, "Data proxy hostname and ip are not included in whitelist", nil)
-			return
-		}
-	}
-
-	if ds.Type == m.DS_CLOUDWATCH {
+	switch ds.Type {
+	case m.DS_CLOUDWATCH:
 		cloudwatch.HandleRequest(c, ds)
 
-	} else if ds.Type == m.DS_SQLDB {
+	case m.DS_SQLDB:
+		host, _ := ds.JsonData.Get("host").String()
+		if !checkWhiteList(c, host) {
+			return
+		}
+
 		sqldb.HandleRequest(c, ds)
 
-	} else {
+	default:
+		targetUrl, _ := url.Parse(ds.Url)
+		if !checkWhiteList(c, targetUrl.Host) {
+			return
+		}
+
 		proxyPath := c.Params("*")
 		proxy := NewReverseProxy(ds, proxyPath, targetUrl)
 		proxy.Transport = dataProxyTransport
@@ -113,3 +116,14 @@ func ProxyDataSourceRequest(c *middleware.Context) {
 		c.Resp.Header().Del("Set-Cookie")
 	}
 }
+
+func checkWhiteList(c *middleware.Context, host string) bool {
+	if host != "" && len(setting.DataProxyWhiteList) > 0 {
+		if _, exists := setting.DataProxyWhiteList[host]; !exists {
+			c.JsonApiErr(403, "Data proxy hostname and ip are not included in whitelist", nil)
+			return false
+		}
+	}
+
+	return true
+}