From be4dc6fdb6ae70deb66157a30d68c3802deed28b Mon Sep 17 00:00:00 2001 From: Kristian Bremberg <114284895+KristianGrafana@users.noreply.github.com> Date: Wed, 27 Aug 2025 20:30:06 +0200 Subject: [PATCH] BackendSrv: remove ampersand in validatePath (#109725) remove ampersand from fetch URL split Co-authored-by: Isaiah Grigsby --- packages/grafana-data/src/text/sanitize.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/grafana-data/src/text/sanitize.ts b/packages/grafana-data/src/text/sanitize.ts index 4d22046cb31..2dae143ff69 100644 --- a/packages/grafana-data/src/text/sanitize.ts +++ b/packages/grafana-data/src/text/sanitize.ts @@ -156,7 +156,7 @@ export function validatePath(path: OriginalPath): O } // Remove query params and fragments to check only the path portion - const cleaned = originalDecoded.split(/[\?&#]/)[0]; + const cleaned = originalDecoded.split(/[\?#]/)[0]; originalDecoded = cleaned; // If the original string contains traversal attempts, block it