From d6ec6f8ad28f0212e584406730f939105ff6c6d3 Mon Sep 17 00:00:00 2001 From: Marcus Efraimsson Date: Fri, 10 Dec 2021 16:10:04 +0100 Subject: [PATCH] Backport fix to main (#42979) * fixes (cherry picked from commit a2c386915ce11b9422f4af8ae181eaa1a22bc5c3) (cherry picked from commit 06706efbbe59ad9d3075835cc31e2f734e36df95) * fix regex (cherry picked from commit a259213a3badc9618e969f2c8db0a0143f00faee) (cherry picked from commit 1d7105c0959df2083814237024f7ec098a76099b) * lint (#42970) (cherry picked from commit afb9e8e5f3c33fa59c5a1053d98d8d97815af002) Co-authored-by: Will Browne Co-authored-by: malcolmholmes <42545407+malcolmholmes@users.noreply.github.com> --- pkg/api/plugins.go | 16 ++++++++++------ pkg/tsdb/testdatasource/csv_data.go | 5 +++-- 2 files changed, 13 insertions(+), 8 deletions(-) diff --git a/pkg/api/plugins.go b/pkg/api/plugins.go index ca076671e36..7cf31dedd40 100644 --- a/pkg/api/plugins.go +++ b/pkg/api/plugins.go @@ -490,15 +490,15 @@ func (hs *HTTPServer) pluginMarkdown(ctx context.Context, pluginId string, name } // nolint:gosec - // We can ignore the gosec G304 warning on this one because `plugin.PluginDir` is based - // on plugin the folder structure on disk and not user input. - path := filepath.Join(plugin.PluginDir, fmt.Sprintf("%s.md", strings.ToUpper(name))) + // We can ignore the gosec G304 warning since we have cleaned the requested file path and subsequently + // use this with a prefix of the plugin's directory, which is set during plugin loading + path := filepath.Join(plugin.PluginDir, mdFilepath(strings.ToUpper(name))) exists, err := fs.Exists(path) if err != nil { return nil, err } if !exists { - path = filepath.Join(plugin.PluginDir, fmt.Sprintf("%s.md", strings.ToLower(name))) + path = filepath.Join(plugin.PluginDir, mdFilepath(strings.ToLower(name))) } exists, err = fs.Exists(path) @@ -510,11 +510,15 @@ func (hs *HTTPServer) pluginMarkdown(ctx context.Context, pluginId string, name } // nolint:gosec - // We can ignore the gosec G304 warning on this one because `plugin.PluginDir` is based - // on plugin the folder structure on disk and not user input. + // We can ignore the gosec G304 warning since we have cleaned the requested file path and subsequently + // use this with a prefix of the plugin's directory, which is set during plugin loading data, err := ioutil.ReadFile(path) if err != nil { return nil, err } return data, nil } + +func mdFilepath(mdFilename string) string { + return filepath.Clean(filepath.Join("/", fmt.Sprintf("%s.md", mdFilename))) +} diff --git a/pkg/tsdb/testdatasource/csv_data.go b/pkg/tsdb/testdatasource/csv_data.go index 2c1b56517ab..78641c0c310 100644 --- a/pkg/tsdb/testdatasource/csv_data.go +++ b/pkg/tsdb/testdatasource/csv_data.go @@ -77,13 +77,14 @@ func (s *Service) handleCsvFileScenario(ctx context.Context, req *backend.QueryD } func (s *Service) loadCsvFile(fileName string) (*data.Frame, error) { - validFileName := regexp.MustCompile(`([\w_]+)\.csv`) + validFileName := regexp.MustCompile(`^\w+\.csv$`) if !validFileName.MatchString(fileName) { return nil, fmt.Errorf("invalid csv file name: %q", fileName) } - filePath := filepath.Join(s.cfg.StaticRootPath, "testdata", fileName) + csvFilepath := filepath.Clean(filepath.Join("/", fileName)) + filePath := filepath.Join(s.cfg.StaticRootPath, "testdata", csvFilepath) // Can ignore gosec G304 here, because we check the file pattern above // nolint:gosec