Plugins: Always validate root URL if specified in signature manfiest (#52332)

* always validate root URL if specified in signature

* tidy imports

pkg/plugins/manager/signature/manifest.go

@@ -145,7 +145,7 @@ func Calculate(mlog log.Logger, plugin *plugins.Plugin) (plugins.Signature, erro
 	}
 
 	// Validate that private is running within defined root URLs
-	if manifest.SignatureType == plugins.PrivateSignature {
+	if manifest.SignatureType == plugins.PrivateSignature || len(manifest.RootURLs) > 0 {
 		appURL, err := url.Parse(setting.AppUrl)
 		if err != nil {
 			return plugins.Signature{}, err

pkg/plugins/manager/signature/manifest_test.go

@@ -1,11 +1,14 @@
 package signature
 
 import (
+	"path/filepath"
 	"sort"
 	"strings"
 	"testing"
 
+	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/plugins"
+	"github.com/grafana/grafana/pkg/setting"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -113,6 +116,57 @@ khdr/tZ1PDgRxMqB/u+Vtbpl0xSxgblnrDOYMSI=
 	})
 }
 
+func TestCalculate(t *testing.T) {
+	t.Run("Validate root URL against App URL for non-private plugin if is specified in manifest", func(t *testing.T) {
+		tcs := []struct {
+			appURL            string
+			expectedSignature plugins.Signature
+		}{
+			{
+				appURL: "https://dev.grafana.com",
+				expectedSignature: plugins.Signature{
+					Status:     plugins.SignatureValid,
+					Type:       plugins.GrafanaSignature,
+					SigningOrg: "Grafana Labs",
+				},
+			},
+			{
+				appURL: "https://non.matching.url.com",
+				expectedSignature: plugins.Signature{
+					Status: plugins.SignatureInvalid,
+				},
+			},
+		}
+
+		parentDir, err := filepath.Abs("../")
+		if err != nil {
+			t.Errorf("could not construct absolute path of current dir")
+			return
+		}
+
+		for _, tc := range tcs {
+			origAppURL := setting.AppUrl
+			t.Cleanup(func() {
+				setting.AppUrl = origAppURL
+			})
+			setting.AppUrl = tc.appURL
+
+			sig, err := Calculate(log.NewNopLogger(), &plugins.Plugin{
+				JSONData: plugins.JSONData{
+					ID: "test",
+					Info: plugins.Info{
+						Version: "1.0.0",
+					},
+				},
+				PluginDir: filepath.Join(parentDir, "testdata/non-pvt-with-root-url/plugin"),
+				Class:     plugins.External,
+			})
+			require.NoError(t, err)
+			require.Equal(t, tc.expectedSignature, sig)
+		}
+	})
+}
+
 func fileList(manifest *pluginManifest) []string {
 	var keys []string
 	for k := range manifest.Files {