From b3f4a71c773b2a53e1e8eb252587a2cfc9661c47 Mon Sep 17 00:00:00 2001 From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com> Date: Mon, 5 Sep 2022 15:24:08 +0200 Subject: [PATCH] API: Do not expose user input in datasource error responses (#53483) (#54707) (cherry picked from commit 950715b2550530f869c36130c878e7af03d1f38a) Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com> --- pkg/api/datasources.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/api/datasources.go b/pkg/api/datasources.go index 5a28f4a9110..55fea4d9696 100644 --- a/pkg/api/datasources.go +++ b/pkg/api/datasources.go @@ -74,7 +74,7 @@ func (hs *HTTPServer) GetDataSources(c *models.ReqContext) response.Response { func (hs *HTTPServer) GetDataSourceById(c *models.ReqContext) response.Response { id, err := strconv.ParseInt(web.Params(c.Req)[":id"], 10, 64) if err != nil { - return response.Error(http.StatusBadRequest, "id is invalid", err) + return response.Error(http.StatusBadRequest, "id is invalid", nil) } query := models.GetDataSourceQuery{ Id: id, @@ -435,7 +435,7 @@ func (hs *HTTPServer) GetDataSourceIdByName(c *models.ReqContext) response.Respo func (hs *HTTPServer) CallDatasourceResource(c *models.ReqContext) { datasourceID, err := strconv.ParseInt(web.Params(c.Req)[":id"], 10, 64) if err != nil { - c.JsonApiErr(http.StatusBadRequest, "id is invalid", err) + c.JsonApiErr(http.StatusBadRequest, "id is invalid", nil) return } ds, err := hs.DataSourceCache.GetDatasource(c.Req.Context(), datasourceID, c.SignedInUser, c.SkipCache) @@ -494,7 +494,7 @@ func convertModelToDtos(ds *models.DataSource) dtos.DataSource { func (hs *HTTPServer) CheckDatasourceHealth(c *models.ReqContext) response.Response { datasourceID, err := strconv.ParseInt(web.Params(c.Req)[":id"], 10, 64) if err != nil { - return response.Error(http.StatusBadRequest, "id is invalid", err) + return response.Error(http.StatusBadRequest, "id is invalid", nil) } ds, err := hs.DataSourceCache.GetDatasource(c.Req.Context(), datasourceID, c.SignedInUser, c.SkipCache)