From 3110e11330abc11d68e13cc34e1f4f3f90170abf Mon Sep 17 00:00:00 2001 From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com> Date: Thu, 11 Nov 2021 00:19:44 -0700 Subject: [PATCH] fix: check lotex endpoint URL (#41429) (#41585) * fix: check lotex endpoint URL * Add validation for data sources URLs Co-authored-by: Santiago (cherry picked from commit dbe78e47b13ffa705684d73b8932106b46c6f9eb) Co-authored-by: Gilles De Mey --- pkg/services/ngalert/api/lotex_prom.go | 5 +++++ pkg/services/ngalert/api/lotex_ruler.go | 20 +++++++++++++------- 2 files changed, 18 insertions(+), 7 deletions(-) diff --git a/pkg/services/ngalert/api/lotex_prom.go b/pkg/services/ngalert/api/lotex_prom.go index 4c5c1f1de6b..5f96ac9c600 100644 --- a/pkg/services/ngalert/api/lotex_prom.go +++ b/pkg/services/ngalert/api/lotex_prom.go @@ -80,6 +80,11 @@ func (p *LotexProm) getEndpoints(ctx *models.ReqContext) (*promEndpoints, error) if err != nil { return nil, err } + + if ds.Url == "" { + return nil, fmt.Errorf("URL for this data source is empty") + } + routes, ok := dsTypeToLotexRoutes[ds.Type] if !ok { return nil, fmt.Errorf("unexpected datasource type. expecting loki or prometheus") diff --git a/pkg/services/ngalert/api/lotex_ruler.go b/pkg/services/ngalert/api/lotex_ruler.go index 57ab79a0d65..d76b2b6c177 100644 --- a/pkg/services/ngalert/api/lotex_ruler.go +++ b/pkg/services/ngalert/api/lotex_ruler.go @@ -33,7 +33,7 @@ func NewLotexRuler(proxy *AlertingProxy, log log.Logger) *LotexRuler { } func (r *LotexRuler) RouteDeleteNamespaceRulesConfig(ctx *models.ReqContext) response.Response { - legacyRulerPrefix, err := r.getPrefix(ctx) + legacyRulerPrefix, err := r.validateAndGetPrefix(ctx) if err != nil { return ErrResp(500, err, "") } @@ -51,7 +51,7 @@ func (r *LotexRuler) RouteDeleteNamespaceRulesConfig(ctx *models.ReqContext) res } func (r *LotexRuler) RouteDeleteRuleGroupConfig(ctx *models.ReqContext) response.Response { - legacyRulerPrefix, err := r.getPrefix(ctx) + legacyRulerPrefix, err := r.validateAndGetPrefix(ctx) if err != nil { return ErrResp(500, err, "") } @@ -74,7 +74,7 @@ func (r *LotexRuler) RouteDeleteRuleGroupConfig(ctx *models.ReqContext) response } func (r *LotexRuler) RouteGetNamespaceRulesConfig(ctx *models.ReqContext) response.Response { - legacyRulerPrefix, err := r.getPrefix(ctx) + legacyRulerPrefix, err := r.validateAndGetPrefix(ctx) if err != nil { return ErrResp(500, err, "") } @@ -96,7 +96,7 @@ func (r *LotexRuler) RouteGetNamespaceRulesConfig(ctx *models.ReqContext) respon } func (r *LotexRuler) RouteGetRulegGroupConfig(ctx *models.ReqContext) response.Response { - legacyRulerPrefix, err := r.getPrefix(ctx) + legacyRulerPrefix, err := r.validateAndGetPrefix(ctx) if err != nil { return ErrResp(500, err, "") } @@ -119,10 +119,11 @@ func (r *LotexRuler) RouteGetRulegGroupConfig(ctx *models.ReqContext) response.R } func (r *LotexRuler) RouteGetRulesConfig(ctx *models.ReqContext) response.Response { - legacyRulerPrefix, err := r.getPrefix(ctx) + legacyRulerPrefix, err := r.validateAndGetPrefix(ctx) if err != nil { return ErrResp(500, err, "") } + return r.withReq( ctx, http.MethodGet, @@ -137,7 +138,7 @@ func (r *LotexRuler) RouteGetRulesConfig(ctx *models.ReqContext) response.Respon } func (r *LotexRuler) RoutePostNameRulesConfig(ctx *models.ReqContext, conf apimodels.PostableRuleGroupConfig) response.Response { - legacyRulerPrefix, err := r.getPrefix(ctx) + legacyRulerPrefix, err := r.validateAndGetPrefix(ctx) if err != nil { return ErrResp(500, err, "") } @@ -150,11 +151,16 @@ func (r *LotexRuler) RoutePostNameRulesConfig(ctx *models.ReqContext, conf apimo return r.withReq(ctx, http.MethodPost, u, bytes.NewBuffer(yml), jsonExtractor(nil), nil) } -func (r *LotexRuler) getPrefix(ctx *models.ReqContext) (string, error) { +func (r *LotexRuler) validateAndGetPrefix(ctx *models.ReqContext) (string, error) { ds, err := r.DataProxy.DataSourceCache.GetDatasource(ctx.ParamsInt64(":Recipient"), ctx.SignedInUser, ctx.SkipCache) if err != nil { return "", err } + // Validate URL + if ds.Url == "" { + return "", fmt.Errorf("URL for this data source is empty") + } + prefix, ok := dsTypeToRulerPrefix[ds.Type] if !ok { return "", fmt.Errorf("unexpected datasource type. expecting loki or prometheus")