From 27f383ae504e43fa92b2bc3947566eb00e7b6b22 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 24 Jan 2025 20:37:42 +0000 Subject: [PATCH] apply security patch: v11.2.x/308-202501232104.patch commit 50c0dd282b73ed95b7c5a9033935203f556b239d Author: Matt Jacobson Date: Thu Jan 23 15:26:33 2025 -0500 CVE-2024-11741 - victorops url --- go.mod | 2 +- go.sum | 2 ++ pkg/services/ngalert/api/tooling/definitions/contact_points.go | 2 +- .../ngalert/notifier/channels_config/available_channels.go | 1 + 4 files changed, 5 insertions(+), 2 deletions(-) diff --git a/go.mod b/go.mod index 677ff7d31cb..8d02a68e16d 100644 --- a/go.mod +++ b/go.mod @@ -74,7 +74,7 @@ require ( github.com/googleapis/gax-go/v2 v2.12.3 // @grafana/grafana-backend-group github.com/gorilla/mux v1.8.1 // @grafana/grafana-backend-group github.com/gorilla/websocket v1.5.0 // @grafana/grafana-app-platform-squad - github.com/grafana/alerting v0.0.0-20240723124849-f2ab7c7b8f7d // @grafana/alerting-backend + github.com/grafana/alerting v0.0.0-20250123201013-8f75d6de2d20 // @grafana/alerting-backend github.com/grafana/authlib v0.0.0-20240730122259-a0d13672efb1 // @grafana/identity-access-team github.com/grafana/codejen v0.0.3 // @grafana/dataviz-squad github.com/grafana/cuetsy v0.1.11 // @grafana/grafana-as-code diff --git a/go.sum b/go.sum index 14b2f35e397..f90ef5c3f35 100644 --- a/go.sum +++ b/go.sum @@ -2303,6 +2303,8 @@ github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWm github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= github.com/grafana/alerting v0.0.0-20240723124849-f2ab7c7b8f7d h1:d2NZeTs+zBPVMd8uOOV5+6lyfs0BCDKxtiNxIMjnPNA= github.com/grafana/alerting v0.0.0-20240723124849-f2ab7c7b8f7d/go.mod h1:DLj8frbtCaITljC2jc0L85JQViPF3mPfOSiYhm1osso= +github.com/grafana/alerting v0.0.0-20250123201013-8f75d6de2d20 h1:H6z5NS/uDM+95JuAY/vGJzJya6xjIUmrTaLDBnSnYX0= +github.com/grafana/alerting v0.0.0-20250123201013-8f75d6de2d20/go.mod h1:DLj8frbtCaITljC2jc0L85JQViPF3mPfOSiYhm1osso= github.com/grafana/authlib v0.0.0-20240730122259-a0d13672efb1 h1:EiaupmOnt6XF/LPxvagjTofWmByzYaf5VyMIF+w/71M= github.com/grafana/authlib v0.0.0-20240730122259-a0d13672efb1/go.mod h1:YA9We4kTafu7mlMnUh3In6Q2wpg8fYN3ycgCKOK1TB8= github.com/grafana/codejen v0.0.3 h1:tAWxoTUuhgmEqxJPOLtJoxlPBbMULFwKFOcRsPRPXDw= diff --git a/pkg/services/ngalert/api/tooling/definitions/contact_points.go b/pkg/services/ngalert/api/tooling/definitions/contact_points.go index 238e65bce61..e1ec79288bd 100644 --- a/pkg/services/ngalert/api/tooling/definitions/contact_points.go +++ b/pkg/services/ngalert/api/tooling/definitions/contact_points.go @@ -245,7 +245,7 @@ type ThreemaIntegration struct { type VictoropsIntegration struct { DisableResolveMessage *bool `json:"-" yaml:"-" hcl:"disable_resolve_message"` - URL string `json:"url" yaml:"url" hcl:"url"` + URL Secret `json:"url" yaml:"url" hcl:"url"` MessageType *string `json:"messageType,omitempty" yaml:"messageType,omitempty" hcl:"message_type"` Title *string `json:"title,omitempty" yaml:"title,omitempty" hcl:"title"` diff --git a/pkg/services/ngalert/notifier/channels_config/available_channels.go b/pkg/services/ngalert/notifier/channels_config/available_channels.go index 5fc42b809aa..08ea44dde77 100644 --- a/pkg/services/ngalert/notifier/channels_config/available_channels.go +++ b/pkg/services/ngalert/notifier/channels_config/available_channels.go @@ -387,6 +387,7 @@ func GetAvailableNotifiers() []*NotifierPlugin { Placeholder: "VictorOps url", PropertyName: "url", Required: true, + Secure: true, }, { // New in 8.0. Label: "Message Type",