public/grafana
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Plugins: Make proxy endpoints not leak sensitive HTTP headers

Browse Source 
Fixes CVE-2022-31130

(cherry picked from commit 40b319d3d6a9945c05709ce8d4679407f6ccadf0)
This commit is contained in:
Marcus Efraimsson authored and Sofia Papagiannaki committed 2022-10-11 13:04:37 +03:00
1 parent c4e6e05687
commit 9da278c044
9 files changed
+102 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

pkg/middleware/middleware_basic_auth_test.go
+6
View File
@@ -37,6 +37,9 @@ func TestMiddlewareBasicAuth(t *testing.T) {
assert.True(t, sc.context.IsSignedIn)
assert.Equal(t, orgID, sc.context.OrgId)
assert.Equal(t, models.ROLE_EDITOR, sc.context.OrgRole)
list := contexthandler.AuthHTTPHeaderListFromContext(sc.context.Req.Context())
require.NotNil(t, list)
require.EqualValues(t, []string{"Authorization"}, list.Items)
}, configure)
middlewareScenario(t, "Handle auth", func(t *testing.T, sc *scenarioContext) {
@@ -70,6 +73,9 @@ func TestMiddlewareBasicAuth(t *testing.T) {
assert.True(t, sc.context.IsSignedIn)
assert.Equal(t, id, sc.context.UserId)
list := contexthandler.AuthHTTPHeaderListFromContext(sc.context.Req.Context())
require.NotNil(t, list)
require.EqualValues(t, []string{"Authorization"}, list.Items)
}, configure)
middlewareScenario(t, "Should return error if user is not found", func(t *testing.T, sc *scenarioContext) {