From 457c110b26ac8c2699d7406b36b2aaa8af30babd Mon Sep 17 00:00:00 2001
From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com>
Date: Fri, 29 Jul 2022 09:18:53 -0400
Subject: [PATCH] API: Do not expose user input in datasource error responses
 (#52992) (#52996)

(cherry picked from commit 87004cc22dcd096e496bd94bf8ff0269ae290297)

Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com>
---
 pkg/api/datasources.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkg/api/datasources.go b/pkg/api/datasources.go
index 7a918ca7799..833981091c8 100644
--- a/pkg/api/datasources.go
+++ b/pkg/api/datasources.go
@@ -235,7 +235,8 @@ func (hs *HTTPServer) DeleteDataSourceByName(c *models.ReqContext) response.Resp
 
 func validateURL(cmdType string, url string) response.Response {
 	if _, err := datasource.ValidateURL(cmdType, url); err != nil {
-		return response.Error(400, fmt.Sprintf("Validation error, invalid URL: %q", url), err)
+		datasourcesLogger.Error("Failed to validate URL", "url", url)
+		return response.Error(http.StatusBadRequest, "Validation error, invalid URL", err)
 	}
 
 	return nil