opensource/grafana
1
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-07-30 00:52:16 +08:00
Code Issues Packages Projects Releases Wiki Activity

Plugins: Use file extension allowlist when serving plugin assets instead of checking for UNIX executable (#37688)

Browse Source 
* explicitly check for plugin binary

* remove check completely

* resolve conflicts

* allow module + logos

* add tests

* simplify

* rework to allowlist

* add case

* remove old stuff

* simplify

* add case insensitive test
This commit is contained in:
Will Browne
2021-08-09 16:07:54 +02:00
committed by GitHub
parent fe500315f0
commit e0315dabe8
2 changed files with 107 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
pkg/api/plugins.go
View File

@ -21,6 +21,14 @@ import (
"github.com/grafana/grafana/pkg/setting"
)
var permittedFileExts = []string{
".html", ".xhtml", ".css", ".js", ".json", ".jsonld", ".map", ".mjs",
".jpeg", ".jpg", ".png", ".gif", ".svg", ".webp", ".ico",
".woff", ".woff2", ".eot", ".ttf", ".otf",
".wav", ".mp3",
".md", ".pdf", ".txt",
}
func (hs *HTTPServer) GetPluginList(c *models.ReqContext) response.Response {
typeFilter := c.Query("type")
enabledFilter := c.Query("enabled")
@ -292,9 +300,9 @@ func (hs *HTTPServer) GetPluginAssets(c *models.ReqContext) {
return
}
if shouldExclude(fi) {
if accessForbidden(fi.Name()) {
c.JsonApiErr(403, "Plugin file access forbidden",
fmt.Errorf("access is forbidden to executable plugin file %s", pluginFilePath))
fmt.Errorf("access is forbidden to plugin file %s", pluginFilePath))
return
}
@ -441,12 +449,13 @@ func translatePluginRequestErrorToAPIError(err error) response.Response {
return response.Error(500, "Plugin request failed", err)
}
func shouldExclude(fi os.FileInfo) bool {
normalizedFilename := strings.ToLower(fi.Name())
func accessForbidden(pluginFilename string) bool {
ext := filepath.Ext(pluginFilename)
isUnixExecutable := fi.Mode()&0111 == 0111
isWindowsExecutable := strings.HasSuffix(normalizedFilename, ".exe")
isScript := strings.HasSuffix(normalizedFilename, ".sh")
return isUnixExecutable || isWindowsExecutable || isScript
for _, permittedExt := range permittedFileExts {
if strings.EqualFold(permittedExt, ext) {
return false
}
}
return true
}