mirror of
https://github.com/grafana/grafana.git
synced 2025-08-02 23:53:10 +08:00

* Plugins: Pass hashes for SRI to frontend * Add SRI hashes to frontendsettings DTOs * Add docstring * TestSriHashes * Fix typo * Changed SriHashes to ModuleHash * update loader_test compareOpts * update ModuleHash error message * Add TestModuleHash/no_module.js * Add omitEmpty to moduleHash * Add ModuleHash to api/plugins/${pluginId}/settings * moved ModuleHash field * feat(plugins): add moduleHash to bootData and plugin types * feat(plugins): if moduleHash is available apply it to systemjs importmap * Calculate ModuleHash for CDN provisioned plugins * Add ModuleHash tests for TestCalculate * adjust test case name * removed .envrc * Fix signature verification failing for internal plugins * fix tests * Add pluginsFilesystemSriChecks feature togglemk * renamed FilesystemSriChecksEnabled * refactor(plugin_loader): prefer extending type declaration over ts-error * added a couple more tests * Removed unused features * Removed unused argument from signature.DefaultCalculator call * Removed unused argument from bootstrap.DefaultConstructFunc * Moved ModuleHash to pluginassets service * update docstring * lint * Removed cdn dependency from manifest.Signature * add tests * fix extra parameters in tests * "fix" tests * removed outdated test * removed unused cdn dependency in signature.DefaultCalculator * reduce diff * Cache returned values * Add support for deeply nested plugins (more than 1 hierarchy level) * simplify cache usage * refactor TestService_ModuleHash_Cache * removed unused testdata * re-generate feature toggles * use version for module hash cache * Renamed feature toggle to pluginsSriChecks and use it for both cdn and filesystem * Removed app/types/system-integrity.d.ts * re-generate feature toggles * re-generate feature toggles * feat(plugins): put systemjs integrity hash behind feature flag --------- Co-authored-by: Jack Westbrook <jack.westbrook@gmail.com>
174 lines
5.8 KiB
TypeScript
174 lines
5.8 KiB
TypeScript
import {
|
|
AppPlugin,
|
|
DataSourceApi,
|
|
DataSourceJsonData,
|
|
DataSourcePlugin,
|
|
DataSourcePluginMeta,
|
|
PluginLoadingStrategy,
|
|
PluginMeta,
|
|
} from '@grafana/data';
|
|
import { config } from '@grafana/runtime';
|
|
import { DataQuery } from '@grafana/schema';
|
|
|
|
import { GenericDataSourcePlugin } from '../datasources/types';
|
|
|
|
import builtInPlugins from './built_in_plugins';
|
|
import { getPluginFromCache, registerPluginInCache } from './loader/cache';
|
|
// SystemJS has to be imported before the sharedDependenciesMap
|
|
import { SystemJS } from './loader/systemjs';
|
|
// eslint-disable-next-line import/order
|
|
import { sharedDependenciesMap } from './loader/sharedDependencies';
|
|
import { decorateSystemJSFetch, decorateSystemJSResolve, decorateSystemJsOnload } from './loader/systemjsHooks';
|
|
import { SystemJSWithLoaderHooks } from './loader/types';
|
|
import { buildImportMap, resolveModulePath } from './loader/utils';
|
|
import { importPluginModuleInSandbox } from './sandbox/sandbox_plugin_loader';
|
|
import { isFrontendSandboxSupported } from './sandbox/utils';
|
|
|
|
const imports = buildImportMap(sharedDependenciesMap);
|
|
|
|
SystemJS.addImportMap({ imports });
|
|
|
|
const systemJSPrototype: SystemJSWithLoaderHooks = SystemJS.constructor.prototype;
|
|
|
|
// This instructs SystemJS to load plugin assets using fetch and eval if it returns a truthy value, otherwise
|
|
// it will load the plugin using a script tag. The logic that sets loadingStrategy comes from the backend.
|
|
// See: pkg/services/pluginsintegration/pluginassets/pluginassets.go
|
|
systemJSPrototype.shouldFetch = function (url) {
|
|
const pluginInfo = getPluginFromCache(url);
|
|
const jsTypeRegEx = /^[^#?]+\.(js)([?#].*)?$/;
|
|
|
|
if (!jsTypeRegEx.test(url)) {
|
|
return true;
|
|
}
|
|
|
|
return Boolean(pluginInfo?.loadingStrategy !== PluginLoadingStrategy.script);
|
|
};
|
|
|
|
const originalImport = systemJSPrototype.import;
|
|
// Hook Systemjs import to support plugins that only have a default export.
|
|
systemJSPrototype.import = function (...args: Parameters<typeof originalImport>) {
|
|
return originalImport.apply(this, args).then((module) => {
|
|
if (module && module.__useDefault) {
|
|
return module.default;
|
|
}
|
|
return module;
|
|
});
|
|
};
|
|
|
|
const systemJSFetch = systemJSPrototype.fetch;
|
|
systemJSPrototype.fetch = function (url: string, options?: Record<string, unknown>) {
|
|
return decorateSystemJSFetch(systemJSFetch, url, options);
|
|
};
|
|
|
|
const systemJSResolve = systemJSPrototype.resolve;
|
|
systemJSPrototype.resolve = decorateSystemJSResolve.bind(systemJSPrototype, systemJSResolve);
|
|
|
|
// Older plugins load .css files which resolves to a CSS Module.
|
|
// https://github.com/WICG/webcomponents/blob/gh-pages/proposals/css-modules-v1-explainer.md#importing-a-css-module
|
|
// Any css files loaded via SystemJS have their styles applied onload.
|
|
systemJSPrototype.onload = decorateSystemJsOnload;
|
|
|
|
export async function importPluginModule({
|
|
path,
|
|
pluginId,
|
|
loadingStrategy,
|
|
version,
|
|
isAngular,
|
|
moduleHash,
|
|
}: {
|
|
path: string;
|
|
pluginId: string;
|
|
loadingStrategy: PluginLoadingStrategy;
|
|
version?: string;
|
|
isAngular?: boolean;
|
|
moduleHash?: string;
|
|
}): Promise<System.Module> {
|
|
if (version) {
|
|
registerPluginInCache({ path, version, loadingStrategy });
|
|
}
|
|
|
|
const builtIn = builtInPlugins[path];
|
|
if (builtIn) {
|
|
// for handling dynamic imports
|
|
if (typeof builtIn === 'function') {
|
|
return await builtIn();
|
|
} else {
|
|
return builtIn;
|
|
}
|
|
}
|
|
|
|
const modulePath = resolveModulePath(path);
|
|
|
|
// inject integrity hash into SystemJS import map
|
|
if (config.featureToggles.pluginsSriChecks) {
|
|
const resolvedModule = System.resolve(modulePath);
|
|
const integrityMap = System.getImportMap().integrity;
|
|
|
|
if (moduleHash && integrityMap && !integrityMap[resolvedModule]) {
|
|
SystemJS.addImportMap({
|
|
integrity: {
|
|
[resolvedModule]: moduleHash,
|
|
},
|
|
});
|
|
}
|
|
}
|
|
|
|
// the sandboxing environment code cannot work in nodejs and requires a real browser
|
|
if (await isFrontendSandboxSupported({ isAngular, pluginId })) {
|
|
return importPluginModuleInSandbox({ pluginId });
|
|
}
|
|
|
|
return SystemJS.import(modulePath);
|
|
}
|
|
|
|
export function importDataSourcePlugin(meta: DataSourcePluginMeta): Promise<GenericDataSourcePlugin> {
|
|
const isAngular = meta.angular?.detected ?? meta.angularDetected;
|
|
const fallbackLoadingStrategy = meta.loadingStrategy ?? PluginLoadingStrategy.fetch;
|
|
return importPluginModule({
|
|
path: meta.module,
|
|
version: meta.info?.version,
|
|
isAngular,
|
|
loadingStrategy: fallbackLoadingStrategy,
|
|
pluginId: meta.id,
|
|
moduleHash: meta.moduleHash,
|
|
}).then((pluginExports) => {
|
|
if (pluginExports.plugin) {
|
|
const dsPlugin: GenericDataSourcePlugin = pluginExports.plugin;
|
|
dsPlugin.meta = meta;
|
|
return dsPlugin;
|
|
}
|
|
|
|
if (pluginExports.Datasource) {
|
|
const dsPlugin = new DataSourcePlugin<
|
|
DataSourceApi<DataQuery, DataSourceJsonData>,
|
|
DataQuery,
|
|
DataSourceJsonData
|
|
>(pluginExports.Datasource);
|
|
dsPlugin.setComponentsFromLegacyExports(pluginExports);
|
|
dsPlugin.meta = meta;
|
|
return dsPlugin;
|
|
}
|
|
|
|
throw new Error('Plugin module is missing DataSourcePlugin or Datasource constructor export');
|
|
});
|
|
}
|
|
|
|
export function importAppPlugin(meta: PluginMeta): Promise<AppPlugin> {
|
|
const isAngular = meta.angular?.detected ?? meta.angularDetected;
|
|
const fallbackLoadingStrategy = meta.loadingStrategy ?? PluginLoadingStrategy.fetch;
|
|
return importPluginModule({
|
|
path: meta.module,
|
|
version: meta.info?.version,
|
|
isAngular,
|
|
loadingStrategy: fallbackLoadingStrategy,
|
|
pluginId: meta.id,
|
|
moduleHash: meta.moduleHash,
|
|
}).then((pluginExports) => {
|
|
const plugin: AppPlugin = pluginExports.plugin ? pluginExports.plugin : new AppPlugin();
|
|
plugin.init(meta);
|
|
plugin.meta = meta;
|
|
plugin.setComponentsFromLegacyExports(pluginExports);
|
|
return plugin;
|
|
});
|
|
}
|