From 617cf776bdebb3cbcb8e26db9a7974280eba1378 Mon Sep 17 00:00:00 2001
From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com>
Date: Fri, 29 Jul 2022 09:18:16 -0400
Subject: [PATCH] [v8.5.x] API: Do not expose user input in datasource error
 responses (#52995)

* API: Do not expose user input in datasource error responses (#52992)

(cherry picked from commit 87004cc22dcd096e496bd94bf8ff0269ae290297)

* Remove unused import

Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com>
---
 pkg/api/datasources.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkg/api/datasources.go b/pkg/api/datasources.go
index 71e18314d72..5a28f4a9110 100644
--- a/pkg/api/datasources.go
+++ b/pkg/api/datasources.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"net/http"
 	"sort"
 	"strconv"
@@ -235,7 +234,8 @@ func (hs *HTTPServer) DeleteDataSourceByName(c *models.ReqContext) response.Resp
 
 func validateURL(cmdType string, url string) response.Response {
 	if _, err := datasource.ValidateURL(cmdType, url); err != nil {
-		return response.Error(400, fmt.Sprintf("Validation error, invalid URL: %q", url), err)
+		datasourcesLogger.Error("Failed to validate URL", "url", url)
+		return response.Error(http.StatusBadRequest, "Validation error, invalid URL", err)
 	}
 
 	return nil