public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CloudMigrations: Address CodeQL issue on unsanitized request params (#101125)

Browse Source
This commit is contained in:
Matheus Macabu
2025-02-21 14:29:52 +01:00
committed by GitHub
parent 35b218fe10
commit 77350ce84f
2 changed files with 56 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/cloudmigration/gmsclient/gms_client.go
+36 -8
View File
@@ -8,6 +8,7 @@ import (
"fmt"
"io"
"net/http"
"net/url"
"strings"
"sync"
"time"
@@ -40,7 +41,10 @@ type gmsClientImpl struct {
func (c *gmsClientImpl) ValidateKey(ctx context.Context, cm cloudmigration.CloudMigrationSession) (err error) {
// TODO: there is a lot of boilerplate code in these methods, we should consolidate them when we have a gardening period
path := fmt.Sprintf("%s/api/v1/validate-key", c.buildBasePath(cm.ClusterSlug))
path, err := c.buildURL(cm.ClusterSlug, "/api/v1/validate-key")
if err != nil {
return err
}
ctx, cancel := context.WithTimeout(ctx, c.cfg.CloudMigration.GMSValidateKeyTimeout)
defer cancel()
@@ -78,7 +82,10 @@ func (c *gmsClientImpl) ValidateKey(ctx context.Context, cm cloudmigration.Cloud
}
func (c *gmsClientImpl) StartSnapshot(ctx context.Context, session cloudmigration.CloudMigrationSession) (out *cloudmigration.StartSnapshotResponse, err error) {
path := fmt.Sprintf("%s/api/v1/start-snapshot", c.buildBasePath(session.ClusterSlug))
path, err := c.buildURL(session.ClusterSlug, "/api/v1/start-snapshot")
if err != nil {
return nil, err
}
ctx, cancel := context.WithTimeout(ctx, c.cfg.CloudMigration.GMSStartSnapshotTimeout)
defer cancel()
@@ -123,7 +130,11 @@ func (c *gmsClientImpl) GetSnapshotStatus(ctx context.Context, session cloudmigr
c.getStatusMux.Lock()
defer c.getStatusMux.Unlock()
path := fmt.Sprintf("%s/api/v1/snapshots/%s/status?offset=%d", c.buildBasePath(session.ClusterSlug), snapshot.GMSSnapshotUID, offset)
path, err := c.buildURL(session.ClusterSlug, fmt.Sprintf("/api/v1/snapshots/%s/status?offset=%d", snapshot.GMSSnapshotUID, offset))
if err != nil {
c.log.Error("error parsing snapshot status url", "err", err.Error())
return nil, err
}
ctx, cancel := context.WithTimeout(ctx, c.cfg.CloudMigration.GMSGetSnapshotStatusTimeout)
defer cancel()
@@ -167,7 +178,11 @@ func (c *gmsClientImpl) GetSnapshotStatus(ctx context.Context, session cloudmigr
}
func (c *gmsClientImpl) CreatePresignedUploadUrl(ctx context.Context, session cloudmigration.CloudMigrationSession, snapshot cloudmigration.CloudMigrationSnapshot) (string, error) {
path := fmt.Sprintf("%s/api/v1/snapshots/%s/create-upload-url", c.buildBasePath(session.ClusterSlug), snapshot.GMSSnapshotUID)
path, err := c.buildURL(session.ClusterSlug, fmt.Sprintf("/api/v1/snapshots/%s/create-upload-url", snapshot.GMSSnapshotUID))
if err != nil {
c.log.Error("error parsing upload url", "err", err.Error())
return "", err
}
ctx, cancel := context.WithTimeout(ctx, c.cfg.CloudMigration.GMSCreateUploadUrlTimeout)
defer cancel()
@@ -217,7 +232,11 @@ func (c *gmsClientImpl) ReportEvent(ctx context.Context, session cloudmigration.
ctx, cancel := context.WithTimeout(ctx, c.cfg.CloudMigration.GMSReportEventTimeout)
defer cancel()
path := fmt.Sprintf("%s/api/v1/events", c.buildBasePath(session.ClusterSlug))
path, err := c.buildURL(session.ClusterSlug, "/api/v1/events")
if err != nil {
c.log.Error("parsing events url", "err", err.Error())
return
}
var buf bytes.Buffer
if err := json.NewEncoder(&buf).Encode(event); err != nil {
@@ -255,12 +274,21 @@ func (c *gmsClientImpl) ReportEvent(ctx context.Context, session cloudmigration.
}()
}
func (c *gmsClientImpl) buildBasePath(clusterSlug string) string {
func (c *gmsClientImpl) buildURL(clusterSlug, path string) (string, error) {
domain := c.cfg.CloudMigration.GMSDomain
baseURL := fmt.Sprintf("https://cms-%s.%s/cloud-migrations", clusterSlug, domain)
// Override the host if we are configuring it with a scheme prefix.
if strings.HasPrefix(domain, "http://") || strings.HasPrefix(domain, "https://") {
return domain
baseURL = domain
}
return fmt.Sprintf("https://cms-%s.%s/cloud-migrations", clusterSlug, domain)
parsed, err := url.Parse(baseURL + path)
if err != nil {
return "", fmt.Errorf("building url: %w", err)
}
return parsed.String(), nil
}
// handleGMSErrors parses the error message from GMS and translates it to an appropriate error message