From 87004cc22dcd096e496bd94bf8ff0269ae290297 Mon Sep 17 00:00:00 2001
From: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com>
Date: Fri, 29 Jul 2022 15:46:51 +0300
Subject: [PATCH] API: Do not expose user input in datasource error responses
 (#52992)

---
 pkg/api/datasources.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkg/api/datasources.go b/pkg/api/datasources.go
index 8acd522c85c..3b9bd651e68 100644
--- a/pkg/api/datasources.go
+++ b/pkg/api/datasources.go
@@ -318,7 +318,8 @@ func (hs *HTTPServer) DeleteDataSourceByName(c *models.ReqContext) response.Resp
 
 func validateURL(cmdType string, url string) response.Response {
 	if _, err := datasource.ValidateURL(cmdType, url); err != nil {
-		return response.Error(400, fmt.Sprintf("Validation error, invalid URL: %q", url), err)
+		datasourcesLogger.Error("Failed to validate URL", "url", url)
+		return response.Error(http.StatusBadRequest, "Validation error, invalid URL", err)
 	}
 
 	return nil