Plugins: Prevent passing host environment variables to plugin processes by default (#113412)

* remove pluginsSkipHostEnvVars toggle

* fix tests

pkg/services/pluginsintegration/loader/loader_test.go

@@ -119,12 +119,13 @@ func TestLoader_Load(t *testing.T) {
 						Backend:      true,
 						QueryOptions: map[string]bool{"minInterval": true},
 					},
-					Module:       "core:plugin/cloudwatch",
-					BaseURL:      "public/plugins/cloudwatch",
-					FS:           mustNewStaticFSForTests(t, filepath.Join(corePluginDir(t), "app/plugins/datasource/cloudwatch")),
-					Signature:    plugins.SignatureStatusInternal,
-					Class:        plugins.ClassCore,
-					Translations: map[string]string{},
+					Class:           plugins.ClassCore,
+					BaseURL:         "public/plugins/cloudwatch",
+					FS:              mustNewStaticFSForTests(t, filepath.Join(corePluginDir(t), "app/plugins/datasource/cloudwatch")),
+					Module:          "core:plugin/cloudwatch",
+					Signature:       plugins.SignatureStatusInternal,
+					SkipHostEnvVars: true,
+					Translations:    map[string]string{},
 				},
 			},
 		},
@@ -212,14 +213,15 @@ func TestLoader_Load(t *testing.T) {
 							ExtensionPoints:   []plugins.ExtensionPoint{},
 						},
 					},
-					Class:         plugins.ClassExternal,
-					Module:        "public/plugins/test-app/module.js",
-					BaseURL:       "public/plugins/test-app",
-					FS:            mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "includes-symlinks")),
-					Signature:     "valid",
-					SignatureType: plugins.SignatureTypeGrafana,
-					SignatureOrg:  "Grafana Labs",
-					Translations:  map[string]string{},
+					Class:           plugins.ClassExternal,
+					Module:          "public/plugins/test-app/module.js",
+					BaseURL:         "public/plugins/test-app",
+					FS:              mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "includes-symlinks")),
+					Signature:       "valid",
+					SignatureType:   plugins.SignatureTypeGrafana,
+					SignatureOrg:    "Grafana Labs",
+					SkipHostEnvVars: true,
+					Translations:    map[string]string{},
 				},
 			},
 		},
@@ -265,12 +267,13 @@ func TestLoader_Load(t *testing.T) {
 						Backend: true,
 						State:   plugins.ReleaseStateAlpha,
 					},
-					Class:        plugins.ClassExternal,
-					Module:       "public/plugins/test-datasource/module.js",
-					BaseURL:      "public/plugins/test-datasource",
-					FS:           mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "unsigned-datasource/plugin")),
-					Signature:    "unsigned",
-					Translations: map[string]string{},
+					Class:           plugins.ClassExternal,
+					Module:          "public/plugins/test-datasource/module.js",
+					BaseURL:         "public/plugins/test-datasource",
+					FS:              mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "unsigned-datasource/plugin")),
+					Signature:       "unsigned",
+					SkipHostEnvVars: true,
+					Translations:    map[string]string{},
 				},
 			},
 		},
@@ -329,12 +332,13 @@ func TestLoader_Load(t *testing.T) {
 						Backend: true,
 						State:   plugins.ReleaseStateAlpha,
 					},
-					Class:        plugins.ClassExternal,
-					Module:       "public/plugins/test-datasource/module.js",
-					BaseURL:      "public/plugins/test-datasource",
-					FS:           mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "unsigned-datasource/plugin")),
-					Signature:    plugins.SignatureStatusUnsigned,
-					Translations: map[string]string{},
+					Class:           plugins.ClassExternal,
+					Module:          "public/plugins/test-datasource/module.js",
+					BaseURL:         "public/plugins/test-datasource",
+					FS:              mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "unsigned-datasource/plugin")),
+					Signature:       plugins.SignatureStatusUnsigned,
+					SkipHostEnvVars: true,
+					Translations:    map[string]string{},
 				},
 			},
 		},
@@ -449,13 +453,14 @@ func TestLoader_Load(t *testing.T) {
 						},
 						Backend: false,
 					},
-					DefaultNavURL: "/plugins/test-app/page/root-page-react",
-					FS:            mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "test-app-with-includes")),
-					Class:         plugins.ClassExternal,
-					Signature:     plugins.SignatureStatusUnsigned,
-					Module:        "public/plugins/test-app/module.js",
-					BaseURL:       "public/plugins/test-app",
-					Translations:  map[string]string{},
+					DefaultNavURL:   "/plugins/test-app/page/root-page-react",
+					FS:              mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "test-app-with-includes")),
+					Class:           plugins.ClassExternal,
+					Signature:       plugins.SignatureStatusUnsigned,
+					Module:          "public/plugins/test-app/module.js",
+					BaseURL:         "public/plugins/test-app",
+					SkipHostEnvVars: true,
+					Translations:    map[string]string{},
 				},
 			},
 		},
@@ -546,7 +551,8 @@ func TestLoader_Load_ExternalRegistration(t *testing.T) {
 					ClientID:     "client-id",
 					ClientSecret: "secretz",
 				},
-				Translations: map[string]string{},
+				SkipHostEnvVars: true,
+				Translations:    map[string]string{},
 			},
 		}
 
@@ -641,14 +647,15 @@ func TestLoader_Load_MultiplePlugins(t *testing.T) {
 							Executable: "test",
 							State:      plugins.ReleaseStateAlpha,
 						},
-						Class:         plugins.ClassExternal,
-						Module:        "public/plugins/test-datasource/module.js",
-						BaseURL:       "public/plugins/test-datasource",
-						FS:            mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "valid-v2-pvt-signature/plugin")),
-						Signature:     "valid",
-						SignatureType: plugins.SignatureTypePrivate,
-						SignatureOrg:  "Will Browne",
-						Translations:  map[string]string{},
+						Class:           plugins.ClassExternal,
+						Module:          "public/plugins/test-datasource/module.js",
+						BaseURL:         "public/plugins/test-datasource",
+						FS:              mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "valid-v2-pvt-signature/plugin")),
+						Signature:       "valid",
+						SignatureType:   plugins.SignatureTypePrivate,
+						SignatureOrg:    "Will Browne",
+						SkipHostEnvVars: true,
+						Translations:    map[string]string{},
 					},
 				},
 				pluginErrors: map[string]*plugins.Error{
@@ -760,14 +767,15 @@ func TestLoader_Load_RBACReady(t *testing.T) {
 						},
 						Backend: false,
 					},
-					FS:            mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "test-app-with-roles")),
-					Class:         plugins.ClassExternal,
-					Signature:     plugins.SignatureStatusValid,
-					SignatureType: plugins.SignatureTypePrivate,
-					SignatureOrg:  "gabrielmabille",
-					Module:        "public/plugins/test-app/module.js",
-					BaseURL:       "public/plugins/test-app",
-					Translations:  map[string]string{},
+					FS:              mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "test-app-with-roles")),
+					Class:           plugins.ClassExternal,
+					Signature:       plugins.SignatureStatusValid,
+					SignatureType:   plugins.SignatureTypePrivate,
+					SignatureOrg:    "gabrielmabille",
+					Module:          "public/plugins/test-app/module.js",
+					BaseURL:         "public/plugins/test-app",
+					SkipHostEnvVars: true,
+					Translations:    map[string]string{},
 				},
 			},
 		},
@@ -829,14 +837,15 @@ func TestLoader_Load_Signature_RootURL(t *testing.T) {
 					Backend:    true,
 					Executable: "test",
 				},
-				FS:            mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "valid-v2-pvt-signature-root-url-uri/plugin")),
-				Class:         plugins.ClassExternal,
-				Signature:     plugins.SignatureStatusValid,
-				SignatureType: plugins.SignatureTypePrivate,
-				SignatureOrg:  "Will Browne",
-				Module:        "public/plugins/test-datasource/module.js",
-				BaseURL:       "public/plugins/test-datasource",
-				Translations:  map[string]string{},
+				FS:              mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "valid-v2-pvt-signature-root-url-uri/plugin")),
+				Class:           plugins.ClassExternal,
+				Signature:       plugins.SignatureStatusValid,
+				SignatureType:   plugins.SignatureTypePrivate,
+				SignatureOrg:    "Will Browne",
+				SkipHostEnvVars: true,
+				Module:          "public/plugins/test-datasource/module.js",
+				BaseURL:         "public/plugins/test-datasource",
+				Translations:    map[string]string{},
 			},
 		}
 
@@ -916,14 +925,15 @@ func TestLoader_Load_DuplicatePlugins(t *testing.T) {
 					},
 					Backend: false,
 				},
-				FS:            mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "test-app")),
-				Class:         plugins.ClassExternal,
-				Signature:     plugins.SignatureStatusValid,
-				SignatureType: plugins.SignatureTypeGrafana,
-				SignatureOrg:  "Grafana Labs",
-				Module:        "public/plugins/test-app/module.js",
-				BaseURL:       "public/plugins/test-app",
-				Translations:  map[string]string{},
+				FS:              mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "test-app")),
+				Class:           plugins.ClassExternal,
+				Signature:       plugins.SignatureStatusValid,
+				SignatureType:   plugins.SignatureTypeGrafana,
+				SignatureOrg:    "Grafana Labs",
+				Module:          "public/plugins/test-app/module.js",
+				BaseURL:         "public/plugins/test-app",
+				SkipHostEnvVars: true,
+				Translations:    map[string]string{},
 			},
 		}
 
@@ -1007,14 +1017,15 @@ func TestLoader_Load_SkipUninitializedPlugins(t *testing.T) {
 					},
 					Backend: false,
 				},
-				FS:            mustNewStaticFSForTests(t, pluginDir1),
-				Class:         plugins.ClassExternal,
-				Signature:     plugins.SignatureStatusValid,
-				SignatureType: plugins.SignatureTypeGrafana,
-				SignatureOrg:  "Grafana Labs",
-				Module:        "public/plugins/test-app/module.js",
-				BaseURL:       "public/plugins/test-app",
-				Translations:  map[string]string{},
+				FS:              mustNewStaticFSForTests(t, pluginDir1),
+				Class:           plugins.ClassExternal,
+				Signature:       plugins.SignatureStatusValid,
+				SignatureType:   plugins.SignatureTypeGrafana,
+				SignatureOrg:    "Grafana Labs",
+				Module:          "public/plugins/test-app/module.js",
+				BaseURL:         "public/plugins/test-app",
+				SkipHostEnvVars: true,
+				Translations:    map[string]string{},
 			},
 		}
 
@@ -1169,14 +1180,15 @@ func TestLoader_Load_NestedPlugins(t *testing.T) {
 			},
 			Backend: true,
 		},
-		Module:        "public/plugins/test-datasource/module.js",
-		BaseURL:       "public/plugins/test-datasource",
-		FS:            mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "nested-plugins/parent")),
-		Signature:     plugins.SignatureStatusValid,
-		SignatureType: plugins.SignatureTypeGrafana,
-		SignatureOrg:  "Grafana Labs",
-		Class:         plugins.ClassExternal,
-		Translations:  map[string]string{},
+		Module:          "public/plugins/test-datasource/module.js",
+		BaseURL:         "public/plugins/test-datasource",
+		FS:              mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "nested-plugins/parent")),
+		Signature:       plugins.SignatureStatusValid,
+		SignatureType:   plugins.SignatureTypeGrafana,
+		SignatureOrg:    "Grafana Labs",
+		Class:           plugins.ClassExternal,
+		SkipHostEnvVars: true,
+		Translations:    map[string]string{},
 	}
 
 	child := &plugins.Plugin{
@@ -1213,14 +1225,15 @@ func TestLoader_Load_NestedPlugins(t *testing.T) {
 				ExtensionPoints:   []plugins.ExtensionPoint{},
 			},
 		},
-		Module:        "public/plugins/test-panel/module.js",
-		BaseURL:       "public/plugins/test-panel",
-		FS:            mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "nested-plugins/parent/nested")),
-		Signature:     plugins.SignatureStatusValid,
-		SignatureType: plugins.SignatureTypeGrafana,
-		SignatureOrg:  "Grafana Labs",
-		Class:         plugins.ClassExternal,
-		Translations:  map[string]string{},
+		Module:          "public/plugins/test-panel/module.js",
+		BaseURL:         "public/plugins/test-panel",
+		FS:              mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "nested-plugins/parent/nested")),
+		Signature:       plugins.SignatureStatusValid,
+		SignatureType:   plugins.SignatureTypeGrafana,
+		SignatureOrg:    "Grafana Labs",
+		Class:           plugins.ClassExternal,
+		SkipHostEnvVars: true,
+		Translations:    map[string]string{},
 	}
 
 	parent.Children = []*plugins.Plugin{child}
@@ -1362,15 +1375,16 @@ func TestLoader_Load_NestedPlugins(t *testing.T) {
 				},
 				Backend: false,
 			},
-			Module:        "public/plugins/myorgid-simple-app/module.js",
-			BaseURL:       "public/plugins/myorgid-simple-app",
-			FS:            mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "app-with-child/dist")),
-			DefaultNavURL: "/plugins/myorgid-simple-app/page/root-page-react",
-			Signature:     plugins.SignatureStatusValid,
-			SignatureType: plugins.SignatureTypeGrafana,
-			SignatureOrg:  "Grafana Labs",
-			Class:         plugins.ClassExternal,
-			Translations:  map[string]string{},
+			Module:          "public/plugins/myorgid-simple-app/module.js",
+			BaseURL:         "public/plugins/myorgid-simple-app",
+			FS:              mustNewStaticFSForTests(t, filepath.Join(testDataDir(t), "app-with-child/dist")),
+			DefaultNavURL:   "/plugins/myorgid-simple-app/page/root-page-react",
+			Signature:       plugins.SignatureStatusValid,
+			SignatureType:   plugins.SignatureTypeGrafana,
+			SignatureOrg:    "Grafana Labs",
+			Class:           plugins.ClassExternal,
+			SkipHostEnvVars: true,
+			Translations:    map[string]string{},
 		}
 
 		child := &plugins.Plugin{
@@ -1421,6 +1435,7 @@ func TestLoader_Load_NestedPlugins(t *testing.T) {
 			SignatureType:   plugins.SignatureTypeGrafana,
 			SignatureOrg:    "Grafana Labs",
 			Class:           plugins.ClassExternal,
+			SkipHostEnvVars: true,
 			Translations:    map[string]string{},
 		}