From cf7d07d18b5ae9f969d0ae771ab134f05ba18bbb Mon Sep 17 00:00:00 2001
From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com>
Date: Thu, 18 May 2023 20:56:07 +0200
Subject: [PATCH] [v9.4.x] Prevent crash while executing concurrent mixed
 queries (#876)

Prevent crash while executing concurrent mixed queries (#874)

limit parallel query execution to 1 at a time

(cherry picked from commit 96579a60e19e2a9f2d6bdaeba64e0e702211eb73)

Co-authored-by: Michael Mandrus <41969079+mmandrus@users.noreply.github.com>
---
 pkg/services/query/query.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkg/services/query/query.go b/pkg/services/query/query.go
index a83d6d32745..9038c92fb44 100644
--- a/pkg/services/query/query.go
+++ b/pkg/services/query/query.go
@@ -90,7 +90,10 @@ func (s *Service) QueryData(ctx context.Context, user *user.SignedInUser, skipCa
 // executeConcurrentQueries executes queries to multiple datasources concurrently and returns the aggregate result.
 func (s *Service) executeConcurrentQueries(ctx context.Context, user *user.SignedInUser, skipCache bool, reqDTO dtos.MetricRequest, queriesbyDs map[string][]parsedQuery) (*backend.QueryDataResponse, error) {
 	g, ctx := errgroup.WithContext(ctx)
-	g.SetLimit(8) // arbitrary limit to prevent too many concurrent requests
+	// TODO: Temporarily limiting concurrency here to 1 to avoid concurrent map writes in the plugin middleware that crash the app
+	// This is a workaround to mitigate the security issue. We will implement a more thread-safe way of handling concurrent queries as a next step.
+	g.SetLimit(1)
+	// g.SetLimit(8) // arbitrary limit to prevent too many concurrent requests
 	rchan := make(chan backend.Responses, len(queriesbyDs))
 
 	// Create panic recovery function for loop below