opensource/grafana
1
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-08-01 11:02:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

DataProxy: Populate X-Grafana-Referer header (#60040)

Browse Source 
* ProxyUtil: Populate X-Grafana-Referer header

* ProxyUtil: Move Referer/Origin header removal

So that the removal and setting X-Grafana-Referer logic applies to all
proxied requests and not just datasource proxy.

* ProxyUtil: Test to guard against multiline headers

* ProxyUtil: Explicitly check injected header isn't parsed
This commit is contained in:
Neil Fordyce
2022-12-15 09:08:10 +00:00
committed by GitHub
parent 5dfa59884e
commit b0874d8059
4 changed files with 42 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
pkg/util/proxyutil/proxyutil_test.go
View File

@ -8,6 +8,38 @@ import (
)
func TestPrepareProxyRequest(t *testing.T) {
t.Run("Prepare proxy request should clear Origin and Referer headers", func(t *testing.T) {
req, err := http.NewRequest(http.MethodGet, "/", nil)
require.NoError(t, err)
req.Header.Set("Origin", "https://host.com")
req.Header.Set("Referer", "https://host.com/dashboard")
PrepareProxyRequest(req)
require.NotContains(t, req.Header, "Origin")
require.NotContains(t, req.Header, "Referer")
})
t.Run("Prepare proxy request should set X-Grafana-Referer header", func(t *testing.T) {
req, err := http.NewRequest(http.MethodGet, "/", nil)
require.NoError(t, err)
req.Header.Set("Referer", "https://host.com/dashboard")
PrepareProxyRequest(req)
require.Contains(t, req.Header, "X-Grafana-Referer")
require.Equal(t, "https://host.com/dashboard", req.Header.Get("X-Grafana-Referer"))
})
t.Run("Prepare proxy request X-Grafana-Referer handles multiline", func(t *testing.T) {
req, err := http.NewRequest(http.MethodGet, "/", nil)
require.NoError(t, err)
req.Header.Set("Referer", "https://www.google.ch\r\nOtherHeader:https://www.somethingelse.com")
PrepareProxyRequest(req)
require.Contains(t, req.Header, "X-Grafana-Referer")
require.NotContains(t, req.Header, "OtherHeader")
require.Equal(t, "https://www.google.ch\r\nOtherHeader:https://www.somethingelse.com", req.Header.Get("X-Grafana-Referer"))
})
t.Run("Prepare proxy request should clear X-Forwarded headers", func(t *testing.T) {
req, err := http.NewRequest(http.MethodGet, "/", nil)
require.NoError(t, err)