Security: Fixes for CVE-2022-31107 and CVE-2022-31097 (#52279)

* WIP: Fix XSS in runbook URL (#378)

(cherry picked from commit f4a8d96a4e1259ea25d9cc702a652f1b819db236)
(cherry picked from commit 337c08507b2b1c78ea470192d34cf611fae4b5da)
(cherry picked from commit 54b36a07406ed4e26ff8e161e50eda5401f504da)

* Update grabpl version

(cherry picked from commit b253e87d730f7b8aabdd0b328c5e7a82547c43b3)
(cherry picked from commit 080d3e46f3fcd61555795b9fe8fd6ee2492b422a)

* Fix: Choose Lookup params per auth module

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

Fix: Prefer pointer to struct in lookup

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

Fix: user email for ldap

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

Fix: Use only login for lookup in LDAP

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

Fix: use user email for ldap

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

fix remaining test

fix nit picks

(cherry picked from commit 1eca4aeed878853743cebcf9790b05dd350c4f83)
(cherry picked from commit 0777d100e9263d08f51dbac71aee0766c8a85a92)

* remove better (broke the pipeline)

Co-authored-by: George Robinson <george.robinson@grafana.com>
Co-authored-by: dsotirakis <sotirakis.dim@gmail.com>
Co-authored-by: jguer <joao.guerreiro@grafana.com>

pkg/api/ldap_debug.go

@@ -220,6 +220,11 @@ func (hs *HTTPServer) PostSyncUserWithLDAP(c *models.ReqContext) response.Respon
 		ReqContext:    c,
 		ExternalUser:  user,
 		SignupAllowed: hs.Cfg.LDAPAllowSignup,
+		UserLookupParams: models.UserLookupParams{
+			UserID: &query.Result.Id, // Upsert by ID only
+			Email:  nil,
+			Login:  nil,
+		},
 	}
 
 	err = hs.Login.UpsertUser(c.Req.Context(), upsertCmd)

pkg/api/login_oauth.go

@@ -304,6 +304,11 @@ func (hs *HTTPServer) SyncUser(
 		ReqContext:    ctx,
 		ExternalUser:  extUser,
 		SignupAllowed: connect.IsSignupAllowed(),
+		UserLookupParams: models.UserLookupParams{
+			Email:  &extUser.Email,
+			UserID: nil,
+			Login:  nil,
+		},
 	}
 
 	if err := hs.Login.UpsertUser(ctx.Req.Context(), cmd); err != nil {

pkg/api/user_test.go

@@ -75,7 +75,8 @@ func TestUserAPIEndpoint_userLoggedIn(t *testing.T) {
 		}
 		idToken := "testidtoken"
 		token = token.WithExtra(map[string]interface{}{"id_token": idToken})
-		query := &models.GetUserByAuthInfoQuery{Login: "loginuser", AuthModule: "test", AuthId: "test"}
+		login := "loginuser"
+		query := &models.GetUserByAuthInfoQuery{AuthModule: "test", AuthId: "test", UserLookupParams: models.UserLookupParams{Login: &login}}
 		cmd := &models.UpdateAuthInfoCommand{
 			UserId:     user.Id,
 			AuthId:     query.AuthId,