public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Plugins: Requests validator (#30445)

Browse Source 
* Introduce PluginRequestValidator abstraction with a NoOp implementation

* Update PluginRequestValidator abstraction to use the dsURL instead

* Inject PluginRequestValidator into the HTTPServer and validate requests going through data source proxy

* Inject PluginRequestValidator into the BackendPluginManager and validate requests going through it

* Validate requests going through QueryMetrics & QueryMetricsV2

* Validate BackendPluginManager health requests

* Fix backend plugins manager tests

* Validate requests going through alerting service

* Fix tests

* fix tests

* goimports

Co-authored-by: Leonard Gram <leo@xlson.com>
This commit is contained in:
Joan López de la Franca Beltran
2021-02-03 20:47:45 +01:00
committed by GitHub
co-authored by Leonard Gram
parent 4a324e3d74
commit 6415d2802e
26 changed files with 224 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/metrics.go
+22 -11
View File
@@ -3,6 +3,7 @@ package api
import (
"context"
"errors"
"net/http"
"github.com/grafana/grafana/pkg/expr"
"github.com/grafana/grafana/pkg/models"
@@ -19,7 +20,7 @@ import (
// POST /api/ds/query DataSource query w/ expressions
func (hs *HTTPServer) QueryMetricsV2(c *models.ReqContext, reqDTO dtos.MetricRequest) response.Response {
if len(reqDTO.Queries) == 0 {
return response.Error(400, "No queries found in query", nil)
return response.Error(http.StatusBadRequest, "No queries found in query", nil)
}
request := &tsdb.TsdbQuery{
@@ -43,7 +44,7 @@ func (hs *HTTPServer) QueryMetricsV2(c *models.ReqContext, reqDTO dtos.MetricReq
datasourceID, err := query.Get("datasourceId").Int64()
if err != nil {
hs.log.Debug("Can't process query since it's missing data source ID")
return response.Error(400, "Query missing data source ID", nil)
return response.Error(http.StatusBadRequest, "Query missing data source ID", nil)
}
// For mixed datasource case, each data source is sent in a single request.
@@ -66,17 +67,22 @@ func (hs *HTTPServer) QueryMetricsV2(c *models.ReqContext, reqDTO dtos.MetricReq
})
}
resp, err := tsdb.HandleRequest(c.Req.Context(), ds, request)
err := hs.PluginRequestValidator.Validate(ds.Url, nil)
if err != nil {
return response.Error(500, "Metric request error", err)
return response.Error(http.StatusForbidden, "Access denied", err)
}
statusCode := 200
resp, err := tsdb.HandleRequest(c.Req.Context(), ds, request)
if err != nil {
return response.Error(http.StatusInternalServerError, "Metric request error", err)
}
statusCode := http.StatusOK
for _, res := range resp.Results {
if res.Error != nil {
res.ErrorString = res.Error.Error()
resp.Message = res.ErrorString
statusCode = 400
statusCode = http.StatusBadRequest
}
}
@@ -154,12 +160,12 @@ func (hs *HTTPServer) QueryMetrics(c *models.ReqContext, reqDto dtos.MetricReque
timeRange := tsdb.NewTimeRange(reqDto.From, reqDto.To)
if len(reqDto.Queries) == 0 {
return response.Error(400, "No queries found in query", nil)
return response.Error(http.StatusBadRequest, "No queries found in query", nil)
}
datasourceId, err := reqDto.Queries[0].Get("datasourceId").Int64()
if err != nil {
return response.Error(400, "Query missing datasourceId", nil)
return response.Error(http.StatusBadRequest, "Query missing datasourceId", nil)
}
ds, err := hs.DatasourceCache.GetDatasource(datasourceId, c.SignedInUser, c.SkipCache)
@@ -167,6 +173,11 @@ func (hs *HTTPServer) QueryMetrics(c *models.ReqContext, reqDto dtos.MetricReque
return hs.handleGetDataSourceError(err, datasourceId)
}
err = hs.PluginRequestValidator.Validate(ds.Url, nil)
if err != nil {
return response.Error(http.StatusForbidden, "Access denied", err)
}
request := &tsdb.TsdbQuery{
TimeRange: timeRange,
Debug: reqDto.Debug,
@@ -185,15 +196,15 @@ func (hs *HTTPServer) QueryMetrics(c *models.ReqContext, reqDto dtos.MetricReque
resp, err := tsdb.HandleRequest(c.Req.Context(), ds, request)
if err != nil {
return response.Error(500, "Metric request error", err)
return response.Error(http.StatusInternalServerError, "Metric request error", err)
}
statusCode := 200
statusCode := http.StatusOK
for _, res := range resp.Results {
if res.Error != nil {
res.ErrorString = res.Error.Error()
resp.Message = res.ErrorString
statusCode = 400
statusCode = http.StatusBadRequest
}
}