Chore: sanitize values before being logged from request headers (#49245)

* Chore: sanitize values being logged directly from request headers

pkg/middleware/logger.go

@@ -17,9 +17,11 @@ package middleware
 
 import (
 	"net/http"
+	"net/url"
 	"time"
 
 	"github.com/grafana/grafana/pkg/infra/tracing"
+	"github.com/grafana/grafana/pkg/models"
 	"github.com/grafana/grafana/pkg/services/contexthandler"
 	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/web"
@@ -55,7 +57,7 @@ func Logger(cfg *setting.Cfg) web.Handler {
 				"time_ms", int64(timeTaken),
 				"duration", duration,
 				"size", rw.Size(),
-				"referer", req.Referer(),
+				"referer", sanitizeURL(ctx, req.Referer()),
 			}
 
 			traceID := tracing.TraceIDFromContext(ctx.Req.Context(), false)
@@ -71,3 +73,16 @@ func Logger(cfg *setting.Cfg) web.Handler {
 		}
 	}
 }
+
+func sanitizeURL(ctx *models.ReqContext, s string) string {
+	if s == "" {
+		return s
+	}
+
+	u, err := url.ParseRequestURI(s)
+	if err != nil {
+		ctx.Logger.Warn("Received invalid referer in request headers, removed for log forgery prevention")
+		return ""
+	}
+	return u.String()
+}

pkg/middleware/logger_test.go

@@ -0,0 +1,57 @@
+package middleware
+
+import (
+	"testing"
+
+	"github.com/grafana/grafana/pkg/infra/log"
+	"github.com/grafana/grafana/pkg/models"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_sanitizeURL(t *testing.T) {
+	type args struct {
+		ctx *models.ReqContext
+		s   string
+	}
+	tests := []struct {
+		name string
+		args args
+		want string
+	}{
+		{
+			name: "Receiving empty string should return it",
+			args: args{
+				ctx: &models.ReqContext{
+					Logger: log.New("test.logger"),
+				},
+				s: "",
+			},
+			want: "",
+		},
+		{
+			name: "Receiving valid URL string should return it parsed",
+			args: args{
+				ctx: &models.ReqContext{
+					Logger: log.New("test.logger"),
+				},
+				s: "https://grafana.com/",
+			},
+			want: "https://grafana.com/",
+		},
+		{
+			name: "Receiving invalid URL string should return empty string",
+			args: args{
+				ctx: &models.ReqContext{
+					Logger: log.New("test.logger"),
+				},
+				s: "this is not a valid URL",
+			},
+			want: "",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equalf(t, tt.want, sanitizeURL(tt.args.ctx, tt.args.s), "sanitizeURL(%v, %v)", tt.args.ctx, tt.args.s)
+		})
+	}
+}