public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

apply security patch: release-11.6.1/364-202504020728.patch

Browse Source 
commit 5697757c8006732776de7f4385c2029bb01f67c6
Author: Andres Martinez Gotor <andres.martinez@grafana.com>
Date:   Mon Mar 31 12:15:52 2025 +0200

    Sanitize paths before evaluating access to route
This commit is contained in:
github-actions[bot]
2025-04-22 21:24:22 +00:00
parent 2d4d7cf869
commit 5e30a9ec08
2 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/pluginproxy/ds_proxy_test.go
+8
View File
@@ -274,6 +274,14 @@ func TestDataSourceProxy_routeRule(t *testing.T) {
err = proxy.validateRequest()
require.NoError(t, err)
})
t.Run("path with slashes and user is editor", func(t *testing.T) {
ctx, _ := setUp()
proxy, err := setupDSProxyTest(t, ctx, ds, routes, "//api//admin")
require.NoError(t, err)
err = proxy.validateRequest()
require.Error(t, err)
})
})
t.Run("plugin route with RBAC protection user is allowed", func(t *testing.T) {