From 38958ee7b7d67d5ef82b9535226f3cbe1f56a585 Mon Sep 17 00:00:00 2001 From: "grafana-delivery-bot[bot]" <132647405+grafana-delivery-bot[bot]@users.noreply.github.com> Date: Wed, 27 Aug 2025 15:42:42 -0500 Subject: [PATCH] [release-12.1.2] BackendSrv: remove ampersand in validatePath (#110243) BackendSrv: remove ampersand in validatePath (#109725) remove ampersand from fetch URL split (cherry picked from commit be4dc6fdb6ae70deb66157a30d68c3802deed28b) Co-authored-by: Kristian Bremberg <114284895+KristianGrafana@users.noreply.github.com> Co-authored-by: Isaiah Grigsby --- packages/grafana-data/src/text/sanitize.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/grafana-data/src/text/sanitize.ts b/packages/grafana-data/src/text/sanitize.ts index 8fed4311627..501611aa12b 100644 --- a/packages/grafana-data/src/text/sanitize.ts +++ b/packages/grafana-data/src/text/sanitize.ts @@ -147,7 +147,7 @@ export function validatePath(path: OriginalPath): O } // Remove query params and fragments to check only the path portion - const cleaned = originalDecoded.split(/[\?&#]/)[0]; + const cleaned = originalDecoded.split(/[\?#]/)[0]; originalDecoded = cleaned; // If the original string contains traversal attempts, block it