[v8.5.x] API: Do not expose user input in datasource error responses (#52995)

* API: Do not expose user input in datasource error responses (#52992)

(cherry picked from commit 87004cc22d)

* Remove unused import

Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com>

pkg/api/datasources.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"net/http"
 	"sort"
 	"strconv"
@@ -235,7 +234,8 @@ func (hs *HTTPServer) DeleteDataSourceByName(c *models.ReqContext) response.Resp
 
 func validateURL(cmdType string, url string) response.Response {
 	if _, err := datasource.ValidateURL(cmdType, url); err != nil {
-		return response.Error(400, fmt.Sprintf("Validation error, invalid URL: %q", url), err)
+		datasourcesLogger.Error("Failed to validate URL", "url", url)
+		return response.Error(http.StatusBadRequest, "Validation error, invalid URL", err)
 	}
 
 	return nil