From 515ebf4b4c9d39dacef5ce6c5326384b6a24ddff Mon Sep 17 00:00:00 2001
From: Kyle Brandt <kyle@grafana.com>
Date: Fri, 3 Dec 2021 12:05:38 -0500
Subject: [PATCH] security: fix dir traversal issue

---
 pkg/api/plugins.go | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/pkg/api/plugins.go b/pkg/api/plugins.go
index cfa215fa3ba..44be12aecd9 100644
--- a/pkg/api/plugins.go
+++ b/pkg/api/plugins.go
@@ -265,9 +265,21 @@ func (hs *HTTPServer) GetPluginAssets(c *models.ReqContext) {
 		return
 	}
 
-	requestedFile := filepath.Clean(c.Params("*"))
-	pluginFilePath := filepath.Join(plugin.PluginDir, requestedFile)
+	requestedFile := filepath.Clean(filepath.Join("/", c.Params("*")))
+	rel, err := filepath.Rel("/", requestedFile)
+	if err != nil {
+		// this should not never fail
+		c.Handle(hs.Cfg, 500, "Relative path found", err)
+		return
+	}
 
+	absPluginDir, err := filepath.Abs(plugin.PluginDir)
+	if err != nil {
+		c.Handle(hs.Cfg, 500, "Failed to get plugin absolute path", nil)
+		return
+	}
+
+	pluginFilePath := filepath.Join(absPluginDir, rel)
 	// It's safe to ignore gosec warning G304 since we already clean the requested file path and subsequently
 	// use this with a prefix of the plugin's directory, which is set during plugin loading
 	// nolint:gosec