From e45867c635091911d32d31461d6e6dee82408e37 Mon Sep 17 00:00:00 2001
From: Esteban Beltran <academo@users.noreply.github.com>
Date: Fri, 29 Sep 2023 17:15:04 +0200
Subject: [PATCH] Sandbox: allow access to window.grafanaBootData for plugins
 (#75522)

* Sandbox: allow access to window.grafanaBootData for plugins

* Do not overlog access to bootdata

* Fix wrong string
---
 .../plugins/sandbox/sandbox_plugin_loader.ts  | 33 ++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/public/app/features/plugins/sandbox/sandbox_plugin_loader.ts b/public/app/features/plugins/sandbox/sandbox_plugin_loader.ts
index 90ab57515ae..15a06af9f5d 100644
--- a/public/app/features/plugins/sandbox/sandbox_plugin_loader.ts
+++ b/public/app/features/plugins/sandbox/sandbox_plugin_loader.ts
@@ -1,7 +1,8 @@
 import createVirtualEnvironment from '@locker/near-membrane-dom';
 import { ProxyTarget } from '@locker/near-membrane-shared';
 
-import { PluginMeta } from '@grafana/data';
+import { BootData, PluginMeta } from '@grafana/data';
+import { config, logInfo } from '@grafana/runtime';
 import { defaultTrustedTypesPolicy } from 'app/core/trustedTypePolicies';
 
 import { getPluginSettings } from '../pluginSettings';
@@ -26,6 +27,7 @@ if (process.env.NODE_ENV !== 'production') {
 }
 
 const pluginImportCache = new Map<string, Promise<System.Module>>();
+const pluginLogCache: Record<string, boolean> = {};
 
 export async function importPluginModuleInSandbox({ pluginId }: { pluginId: string }): Promise<System.Module> {
   try {
@@ -68,6 +70,7 @@ async function doImportPluginModuleInSandbox(meta: PluginMeta): Promise<System.M
       }
       return originalValue;
     }
+
     // each plugin has its own sandbox
     sandboxEnvironment = createVirtualEnvironment(window, {
       // distortions are interceptors to modify the behavior of objects when
@@ -91,6 +94,34 @@ async function doImportPluginModuleInSandbox(meta: PluginMeta): Promise<System.M
           // Similar to `window.monaco`, `window.Prism` may be undefined when invoked.
           return Reflect.get(window, 'Prism');
         },
+        get grafanaBootData(): BootData {
+          if (!pluginLogCache[meta.id + '-grafanaBootData']) {
+            pluginLogCache[meta.id + '-grafanaBootData'] = true;
+            logInfo('Plugin using window.grafanaBootData', {
+              sandbox: 'true',
+              pluginId: meta.id,
+              guessedPluginName: meta.id,
+              parent: 'window',
+              packageName: 'window',
+              key: 'grafanaBootData',
+            });
+          }
+
+          // We don't want to encourage plugins to use `window.grafanaBootData`. They should
+          // use `@grafana/runtime.config` instead.
+          // if we are in dev mode we fail this access
+          if (config.buildInfo.env === 'development') {
+            throw new Error(
+              `Error in ${meta.id}: Plugins should not use window.grafanaBootData. Use "config" from "@grafana/runtime" instead.`
+            );
+          } else {
+            console.error(
+              `${meta.id.toUpperCase()}: Plugins should not use window.grafanaBootData. Use "config" from "@grafana/runtime" instead.`
+            );
+          }
+          return config.bootData;
+        },
+
         // Plugins builds use the AMD module system. Their code consists
         // of a single function call to `define()` that internally contains all the plugin code.
         // This is that `define` function the plugin will call.