From dbe78e47b13ffa705684d73b8932106b46c6f9eb Mon Sep 17 00:00:00 2001 From: Gilles De Mey Date: Thu, 11 Nov 2021 07:45:56 +0100 Subject: [PATCH] fix: check lotex endpoint URL (#41429) * fix: check lotex endpoint URL * Add validation for data sources URLs Co-authored-by: Santiago --- pkg/services/ngalert/api/lotex_prom.go | 5 +++++ pkg/services/ngalert/api/lotex_ruler.go | 20 +++++++++++++------- 2 files changed, 18 insertions(+), 7 deletions(-) diff --git a/pkg/services/ngalert/api/lotex_prom.go b/pkg/services/ngalert/api/lotex_prom.go index 4c5c1f1de6b..5f96ac9c600 100644 --- a/pkg/services/ngalert/api/lotex_prom.go +++ b/pkg/services/ngalert/api/lotex_prom.go @@ -80,6 +80,11 @@ func (p *LotexProm) getEndpoints(ctx *models.ReqContext) (*promEndpoints, error) if err != nil { return nil, err } + + if ds.Url == "" { + return nil, fmt.Errorf("URL for this data source is empty") + } + routes, ok := dsTypeToLotexRoutes[ds.Type] if !ok { return nil, fmt.Errorf("unexpected datasource type. expecting loki or prometheus") diff --git a/pkg/services/ngalert/api/lotex_ruler.go b/pkg/services/ngalert/api/lotex_ruler.go index 8808f5befdc..e916ebf598a 100644 --- a/pkg/services/ngalert/api/lotex_ruler.go +++ b/pkg/services/ngalert/api/lotex_ruler.go @@ -33,7 +33,7 @@ func NewLotexRuler(proxy *AlertingProxy, log log.Logger) *LotexRuler { } func (r *LotexRuler) RouteDeleteNamespaceRulesConfig(ctx *models.ReqContext) response.Response { - legacyRulerPrefix, err := r.getPrefix(ctx) + legacyRulerPrefix, err := r.validateAndGetPrefix(ctx) if err != nil { return ErrResp(500, err, "") } @@ -51,7 +51,7 @@ func (r *LotexRuler) RouteDeleteNamespaceRulesConfig(ctx *models.ReqContext) res } func (r *LotexRuler) RouteDeleteRuleGroupConfig(ctx *models.ReqContext) response.Response { - legacyRulerPrefix, err := r.getPrefix(ctx) + legacyRulerPrefix, err := r.validateAndGetPrefix(ctx) if err != nil { return ErrResp(500, err, "") } @@ -74,7 +74,7 @@ func (r *LotexRuler) RouteDeleteRuleGroupConfig(ctx *models.ReqContext) response } func (r *LotexRuler) RouteGetNamespaceRulesConfig(ctx *models.ReqContext) response.Response { - legacyRulerPrefix, err := r.getPrefix(ctx) + legacyRulerPrefix, err := r.validateAndGetPrefix(ctx) if err != nil { return ErrResp(500, err, "") } @@ -96,7 +96,7 @@ func (r *LotexRuler) RouteGetNamespaceRulesConfig(ctx *models.ReqContext) respon } func (r *LotexRuler) RouteGetRulegGroupConfig(ctx *models.ReqContext) response.Response { - legacyRulerPrefix, err := r.getPrefix(ctx) + legacyRulerPrefix, err := r.validateAndGetPrefix(ctx) if err != nil { return ErrResp(500, err, "") } @@ -119,10 +119,11 @@ func (r *LotexRuler) RouteGetRulegGroupConfig(ctx *models.ReqContext) response.R } func (r *LotexRuler) RouteGetRulesConfig(ctx *models.ReqContext) response.Response { - legacyRulerPrefix, err := r.getPrefix(ctx) + legacyRulerPrefix, err := r.validateAndGetPrefix(ctx) if err != nil { return ErrResp(500, err, "") } + return r.withReq( ctx, http.MethodGet, @@ -137,7 +138,7 @@ func (r *LotexRuler) RouteGetRulesConfig(ctx *models.ReqContext) response.Respon } func (r *LotexRuler) RoutePostNameRulesConfig(ctx *models.ReqContext, conf apimodels.PostableRuleGroupConfig) response.Response { - legacyRulerPrefix, err := r.getPrefix(ctx) + legacyRulerPrefix, err := r.validateAndGetPrefix(ctx) if err != nil { return ErrResp(500, err, "") } @@ -150,11 +151,16 @@ func (r *LotexRuler) RoutePostNameRulesConfig(ctx *models.ReqContext, conf apimo return r.withReq(ctx, http.MethodPost, u, bytes.NewBuffer(yml), jsonExtractor(nil), nil) } -func (r *LotexRuler) getPrefix(ctx *models.ReqContext) (string, error) { +func (r *LotexRuler) validateAndGetPrefix(ctx *models.ReqContext) (string, error) { ds, err := r.DataProxy.DataSourceCache.GetDatasource(ctx.ParamsInt64(":Recipient"), ctx.SignedInUser, ctx.SkipCache) if err != nil { return "", err } + // Validate URL + if ds.Url == "" { + return "", fmt.Errorf("URL for this data source is empty") + } + prefix, ok := dsTypeToRulerPrefix[ds.Type] if !ok { return "", fmt.Errorf("unexpected datasource type. expecting loki or prometheus")