public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Live: allow connections with request host matching origin host (#38538)

Browse Source
This commit is contained in:
Alexander Emelin
2021-08-27 13:26:28 +03:00
committed by GitHub
parent b25eb0aa74
commit a95a40d87d
2 changed files with 20 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/live/live.go
+11 -8
View File
@@ -373,25 +373,28 @@ func getCheckOriginFunc(appURL *url.URL, originPatterns []string, originGlobs []
// fast path for *.
return true
}
ok, err := checkAllowedOrigin(strings.ToLower(origin), appURL, originGlobs)
originURL, err := url.Parse(strings.ToLower(origin))
if err != nil {
logger.Warn("Failed to parse request origin", "error", err, "origin", origin)
return false
}
if strings.EqualFold(originURL.Host, r.Host) {
return true
}
ok, err := checkAllowedOrigin(origin, originURL, appURL, originGlobs)
if err != nil {
logger.Warn("Error parsing request origin", "error", err, "origin", origin)
return false
}
if !ok {
logger.Warn("Request Origin is not authorized", "origin", origin, "appUrl", appURL.String(), "allowedOrigins", strings.Join(originPatterns, ","))
logger.Warn("Request Origin is not authorized", "origin", origin, "host", r.Host, "appUrl", appURL.String(), "allowedOrigins", strings.Join(originPatterns, ","))
return false
}
return true
}
}
func checkAllowedOrigin(origin string, appURL *url.URL, originGlobs []glob.Glob) (bool, error) {
originURL, err := url.Parse(origin)
if err != nil {
logger.Warn("Failed to parse request origin", "error", err, "origin", origin)
return false, err
}
func checkAllowedOrigin(origin string, originURL *url.URL, appURL *url.URL, originGlobs []glob.Glob) (bool, error) {
// Try to match over configured [server] root_url first.
if originURL.Port() == "" {
if strings.EqualFold(originURL.Scheme, appURL.Scheme) && strings.EqualFold(originURL.Host, appURL.Hostname()) {