Commit graph

62 commits

Author SHA1 Message Date
Mariell Hoversholm
fb7336fc36
patch(security): apply May 2026 patches (#124824)
* patch(security): Access Control: Fix Editor can remove any annotation

GL-Vuln: VUL-2026-0018
GL-Public-After: 2026-05-12
GL-Partner-Rel: 2026-04-27
GL-Partner-Ack: 2026-02-17

* patch(security): fix(live): limit input body to 500k

GL-Vuln: VUL-2026-0031 https://ops.grafana-ops.net/a/grafana-vulnerabilityobs-app/first-party/63
GL-Partner-Rel: 2026-04-09
GL-Public-After: 2026-05-12
GL-Partner-Ack: 2026-02-25T14:02:00Z

* patch(security): fix(plugins): limit input resource sizes

GL-Vuln: VUL-2026-0032 https://ops.grafana-ops.net/a/grafana-vulnerabilityobs-app/first-party/64
GL-Partner-Rel: 2026-04-09
GL-Public-After: 2026-05-12
GL-Partner-Ack: 2026-02-25T14:02:00Z

* patch(security): patch(security): fix broken access control in snapshot delete handler

GL-Vuln: VUL-2026-0044 https://ops.grafana-ops.net/a/grafana-vulnerabilityobs-app/first-party/76
GL-Partner-Rel: 2026-04-09
GL-Public-After: 2026-05-12
GL-Partner-Ack: 2026-03-31

* patch(security): patch(security): fix auth proxy IPv6 bare whitelist parsing (main)

GL-Vuln: VUL-2026-0045 https://ops.grafana-ops.net/a/grafana-vulnerabilityobs-app/first-party/77
GL-Partner-Rel: 2026-04-09
GL-Public-After: 2026-05-12
GL-Partner-Ack: 2026-03-30

* patch(security): Live: Avoid concurrent map read and map write

GL-Vuln: VUL-2026-0049 https://ops.grafana-ops.net/a/grafana-vulnerabilityobs-app/first-party/81
GL-Partner-Rel: 2026-04-09
GL-Public-After: 2026-05-12
GL-Partner-Ack: 2026-03-18

* patch(security): Dashboards: Fix /import permission setting

GL-Vuln: VUL-2026-0058 https://ops.grafana-ops.net/a/grafana-vulnerabilityobs-app/first-party/90
GL-Partner-Rel: 2026-04-09
GL-Public-After: 2026-05-12
GL-Partner-Ack: 2026-03-24

* patch(security): MSSQL, MySQL, postgres infinite loop exploit

GL-Vuln: VUL-2026-0057 https://ops.grafana-ops.net/a/grafana-vulnerabilityobs-app/first-party/89
GL-Partner-Rel: 2026-04-09
GL-Public-After: 2026-05-12
GL-Partner-Ack: 2026-03-20

* patch(security): patch(security): ServiceAccounts RBAC cache invalidation on permission change

GL-Vuln: VUL-2026-0061
GL-Public-After: 2026-05-12
GL-Partner-Rel: 2026-04-15
GL-Partner-Ack: 2026-04-06

* patch(security): SQL Expressions: Fix Security Bugs

GL-Vuln: VUL-2026-0064
GL-Public-After: 2026-05-12
GL-Partner-Rel: 2026-04-27
GL-Partner-Ack: 2026-04-11

* fix: nolint gocyclo

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-05-13 18:53:11 +02:00
ismail simsek
4fb13216fe
Zipkin: Remove from core plugins (#124148)
* delete zipkin backend

* delete zipkin frontend

* delete zipkin docker devenv

* update codeowners

* remove zipkin from more places

* copy transformToZipkin

* fix: update tests after Zipkin removal from core plugins

- Remove extra Zipkin nil arg from ProvideCoreRegistry call in plugin_resource_test.go
- Update fixture item count from 54 to 53 in v0alpha1AppMapper and v0alpha1PanelMapper tests
- Fix prettier formatting in v0alpha1Response.ts test fixture

Co-authored-by: Cursor <cursoragent@cursor.com>

* lint

* put zipkin back

* remove zipkin e2e test

* update length

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-06 13:31:03 +02:00
Nathan Vērzemnieks
face90d946
Elasticsearch: Remove core datasource (#119956)
* Elasticsearch: Remove core datasource plugin code

Remove the Elasticsearch datasource plugin implementation from the
monorepo as it is being externalized to its own repository. This removes
the Go backend (pkg/tsdb/elasticsearch/), the TypeScript/React frontend
(public/app/plugins/datasource/elasticsearch/), generated schema types,
and all direct references to these deleted paths in wire, plugin
registration, CI configs, CODEOWNERS, eslint, jest, and golangci.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Elasticsearch: Remove e2e and API integration tests

Remove the Playwright e2e smoke test and the Go API integration test
for the Elasticsearch datasource, along with the playwright config
entry, since the core plugin has been removed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Elasticsearch: Fix test compilation after core plugin removal

Remove elasticsearch references from ProvideCoreRegistry test call
and TestNewPlugin test cases.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Elasticsearch: Remove from expected plugin list API snapshot

Remove elasticsearch entry from expectedListResp.json test fixture.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Test catalog plugin bundling

* Elasticsearch: decrement core plugin count in core_test.go

* Add elastic to default preinstall

* Pin bundled Elasticsearch version for now

* Scope down to only remove Elastic

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Andreas Christou <andreas.christou@grafana.com>
2026-03-30 10:49:36 +01:00
Will Browne
ec55871b9b
Plugins: Remove pkg/tsdb/* as dependency (#115886)
* remove deps

* singular

* add rest

* make update-workspace

* undo go.mod changes
2026-01-07 11:28:25 +00:00
Bruno
437dcc875c
QueryCaching: Use CachingServiceClient for query caching (#112128)
* Integrate mt querier with query caching

* typo

* let the caller set cache status response header

* fix TestQueryAPI

* make gen-go

* handle CachingServiceClient being nil and make gen-go

* include namespace in cache key

* set signed in user namespace in query_test.go

* fix test

* remove commented out code

* undo services/query/query.go changes

* make gen-go

* remove namespace requirement

* fix tests

* fix test

* remove namespace from SignedInUser in tests

* make gen-go
2025-10-28 11:41:46 -03:00
Will Browne
2223338e34
Plugins: Update plugin fakes package name (#112503)
update plugin fakes package name
2025-10-16 15:14:05 +01:00
Peter Štibraný
7fd9ab9481
Replace check for integration tests. (#110707)
* Replace check for integration tests.
* Revert changes in pkg/tsdb/mysql packages.
* Fix formatting of few tests.
2025-09-08 15:49:49 +02:00
Serge Zaitsev
a95fb3a37c
Chore: Omit integration tests if short test flag is passed (#108777)
* omit integration tests if short test flag is passed

* Update pkg/services/ngalert/models/receivers_test.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* Update pkg/tests/api/alerting/api_ruler_test.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* Update pkg/tests/api/alerting/api_ruler_test.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* Update pkg/tests/api/alerting/api_ruler_test.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* Update pkg/tests/api/alerting/api_ruler_test.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* Update pkg/tests/api/alerting/api_ruler_test.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* Update pkg/services/ngalert/models/receivers_test.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* Update pkg/cmd/grafana-cli/commands/datamigrations/to_unified_storage_test.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* Update pkg/services/ngalert/models/receivers_test.go

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

* fix the rest

* false positive

---------

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
2025-07-28 13:38:54 +02:00
Serge Zaitsev
f66a693438
Chore: Rename integration tests to follow the common convention (#105987)
* automatically rename integration tests to follow the common convention

* name tests differently

* alter column type to bigint

* update another column to bigint

* add another alter

* fix subquery for mysql
2025-06-29 16:56:24 +02:00
Nathan Vērzemnieks
a18ea34688
CloudWatch: Backport aws-sdk-go-v2 update from external plugin (#107136)
* CloudWatch: Backport aws-sdk-go-v2 update from external plugin

* Review feedback & cleaning up a couple typos
2025-06-26 15:56:50 +02:00
Gareth Dawson
33d82c43df
Jaeger: run health check through backend (#99322)
run health check through backend
2025-01-24 19:37:36 +07:00
Ivana Huckova
4d0a7637b2
Zipkin: Run health check through backend (#96031)
* Zipkin: Run health check through backend

* Mark some errors as downstream

* Update pkg/tsdb/zipkin/zipkin.go

Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>

* Use errors.New where error formatting is not needed

* Remove executable in plugin.json

* Fix joining the path

* Keep logger as global and then create from context

* Close the res body

---------

Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>
2024-11-07 16:48:00 +01:00
Marcus Efraimsson
b7a7f2bd62
Plugins: Use handler middleware from the SDK (#93445)
updates sdk to v0.251.0
2024-09-30 16:33:15 +02:00
Jeff Levin
028e8ac59e
Instrument tracing across accesscontrol (#91864)
Instrument tracing across accesscontrol 

---------

Co-authored-by: Dave Henderson <dave.henderson@grafana.com>
2024-08-16 14:08:19 -08:00
Jeff Levin
cfe8317d45
Add auth spans and remove deduplication code for scopes (#89804)
Adds more spans for timing in accesscontrol and remove permission deduplicating code after benchmarking

---------

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>
Co-authored-by: Dave Henderson <dave.henderson@grafana.com>
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
2024-07-02 22:08:57 -08:00
Dave Henderson
5687243d0b
Feature Flags: use FeatureToggles interface where possible (#85131)
* Feature Flags: use FeatureToggles interface where possible

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>

* Replace TestFeatureToggles with existing WithFeatures

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>

---------

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>
2024-04-04 12:22:31 -04:00
Andreas Christou
7c3f621688
Chore: Update grafana-azure-sdk-go (#84741)
* Update grafana-azure-sdk-go

* Update test
2024-03-19 14:56:40 +00:00
Will Browne
5edd96ae77
Plugins: Refactor plugin config into separate env var and request scoped services (#83261)
* seperate services for env + req

* merge with main

* fix tests

* undo changes to golden file

* fix linter

* remove unused fields

* split out new config struct

* provide config

* undo go mod changes

* more renaming

* fix tests

* undo bra.toml changes

* update go.work.sum

* undo changes

* trigger

* apply PR feedback
2024-02-27 12:38:02 +01:00
Giedrius Statkevičius
6f245121d0
Plugins: Fix colon in CallResource URL returning an error when creating plugin resource request (#79746)
* Plugin: handle colon character in path

url.Parse() does not handle the given input correctly when the input
contains a colon character. The user will see the following error
message when trying to use remote cluster in Elasticsearch:

```
level=warn msg="Failed for create plugin resource request" error="parse \"foo-*,*:foo-*/_mapping\": first path segment in URL cannot contain colon" traceID=
```

As far as I can tell, we only want to set the path here + rawquery so
avoid url.Parse() altogether.

* Add more tests

---------

Co-authored-by: Giuseppe Guerra <giuseppe@guerra.in>
2024-01-29 10:31:49 +01:00
Will Browne
3f30cbf91c
DataSources: Add datasource fetching + querying interface (#80749)
* first pass

* separate oss + enterprise

* tidy things up

* add ctx

* fix tests

* use standalone svcs

* mv plugin context provide

* fix wire

* fix import
2024-01-19 15:56:52 +01:00
Ben Sully
315100e2e3
Plugins: Add Grafana config to app plugin context (#79439) 2023-12-13 10:28:24 +01:00
Ryan McKinley
3509a5abb9
FeatureFlags: Cleanup usage of cfg.IsFeatureToggleEnabled (#78014) 2023-11-13 07:55:15 -08:00
Kyle Brandt
e4d1fdc3d0
Errors: Make errors the same in dev as prod (#77366)
When running in dev mode, error messages would contain an additional "error" property alongside "message". Since this causes confusion, that has been removed and now error messages are the same both modes (using "message").
2023-10-30 14:06:26 -04:00
Giuseppe Guerra
cfcfbe4aaa
Plugins: Refactoring: Implement plugin instrumentation as a middleware (#76011)
* Plugins: Refactor instrumentation as plugin client middleware

* Simplify repeated code

* Fix compilation error

* Add comments

* Moved status and endpoint consts to utils.go

* Fix wrong endpoint name in CheckHealth InstrumentationMiddleware

* Add tests

* Fix wrong endpoint value in instrumentPluginRequestSize

* removed todo

* PR review feedback: use MustRegister

* PR review feedback: move tracing middleware before instrumentation middleware

* PR review feedback: removed decommissioned check

* PR review feedback: extract prometheus metrics into separate variables
2023-10-09 14:12:57 +02:00
Marcus Efraimsson
534e3ebf0c
Plugins: Use a Grafana specific SDK tracer implementation for core plugins (#75388) 2023-09-26 14:46:31 +02:00
Andres Martinez Gotor
c70623fb85
Chore: Rename testdata plugin with a fully qualified name (#75104) 2023-09-22 15:00:40 +03:00
Will Browne
7fca1bde54
Plugins: Set grafana config, plugin version and user agent on plugin requests (#75171)
* first pass

* fixup

* remove test line

* fix tests

* use new fields

* fix imports + formatting

* fix tests

* rollback changes

* undo whitespace

* apply pr feedback
2023-09-21 11:33:31 +02:00
Ryan McKinley
025b2f3011
Chore: use any rather than interface{} (#74066) 2023-08-30 18:46:47 +03:00
Will Browne
72da44db0e
Plugins: Add validation stage to plugin loader pipeline (#73053)
* first pass

* change validation signature

* err tracking

* fix

* undo golden

* 1 more

* fix

* adjust doc

* add test helper

* fix linter
2023-08-09 18:25:28 +02:00
Will Browne
98f827537b
Plugins: Add remaining steps to inititialization stage (#72894)
add remainder of init steps
2023-08-04 12:35:57 +02:00
Will Browne
60b4a0b2a4
Plugins: Add termination stage to plugin loader pipeline (#72822)
* add termination stage

* uid -> pluginID (for now)

* also fix fakes

* add simple test

* Fix logger name

Co-authored-by: Giuseppe Guerra <giuseppe.guerra@grafana.com>

* inline stop func call

Co-authored-by: Giuseppe Guerra <giuseppe.guerra@grafana.com>

---------

Co-authored-by: Giuseppe Guerra <giuseppe.guerra@grafana.com>
2023-08-04 11:57:49 +02:00
Will Browne
ad2705fa0b
Plugins: Add inititialization stage to plugin loader pipeline (#72667)
* first pass

* migrate tests

* simplify

* fix comments

* fix linter

* nil checks

* remove comment
2023-08-02 16:29:12 +00:00
Will Browne
ec6412bcca
Plugins: Use plugins config to source app URL (#72490)
* use plugins config for app URL

* merge with main

* add missing file

* add fg

* fix tests
2023-07-28 15:18:25 +02:00
Will Browne
758d9884bc
Plugins: Plugins loader pipeline (#71438)
* discovery

* flesh out

* add docs

* remove unused func

* bootstrap stage

* fix docs

* update docs

* undo unnecessary changes

* add end tag

* update doc

* fix linter

* fix

* tidy

* update docs

* add class to filter func

* apply PR feedback

* fix test
2023-07-27 15:29:13 +02:00
Will Browne
162dde5bdd
Plugins: Use suffix for plugin directory (#71375)
* plugin dir suffix

* fix whitespace

* fix cli

* fix tests

* fixup

* simplify

* undo uninstall changes
2023-07-14 11:49:05 +02:00
Andres Martinez Gotor
9990d5025d
Chore: Embed CSV files with the test data source (#71435) 2023-07-13 09:34:40 +02:00
Will Browne
1274979f3f
Plugins: Remove unused config field from SignatureCalculator (#71297)
remove unused cfg field
2023-07-11 08:52:02 +02:00
Andres Martinez Gotor
4ff0abd0d1
SaveExternalService (OAuth) on plugin load (#69764) 2023-06-26 16:38:43 +02:00
Giuseppe Guerra
cca9d89733
Plugins: Angular detector: Remote patterns fetching (#69843)
* Plugins: Angular detector: Remote patterns fetching

* Renamed PatternType to GCOMPatternType

* Renamed files

* Renamed more files

* Moved files again

* Add type checks, unexport GCOM structs

* Cache failures, update log messages, fix GCOM URL

* Fail silently for unknown pattern types, update docstrings

* Fix tests

* Rename gcomPattern.Value to gcomPattern.Pattern

* Refactoring

* Add FlagPluginsRemoteAngularDetectionPatterns feature flag

* Fix tests

* Re-generate feature flags

* Add TestProvideInspector, renamed TestDefaultStaticDetectorsInspector

* Add TestProvideInspector

* Add TestContainsBytesDetector and TestRegexDetector

* Renamed getter to provider

* More tests

* TestStaticDetectorsProvider, TestSequenceDetectorsProvider

* GCOM tests

* Lint

* Made detector.detect unexported, updated docstrings

* Allow changing grafana.com URL

* Fix API path, add more logs

* Update tryUpdateRemoteDetectors docstring

* Use angulardetector http client

* Return false, nil if module.js does not exist

* Chore: Split angualrdetector into angularinspector and angulardetector packages

Moved files around, changed references and fixed tests:
- Split the old angulardetector package into angular/angulardetector and angular/angularinspector
- angulardetector provides the detection structs/interfaces (Detector, DetectorsProvider...)
- angularinspector provides the actual angular detection service used directly in pluginsintegration
- Exported most of the stuff that was private and now put into angulardetector, as it is not required by angularinspector

* Renamed detector.go -> angulardetector.go and inspector.go -> angularinspector.go

Forgot to rename those two files to match the package's names

* Renamed angularinspector.ProvideInspector to angularinspector.ProvideService

* Renamed "harcoded" to "static" and "remote" to "dynamic"

from PR review, matches the same naming schema used for signing keys fetching

* Fix merge conflict on updated angular patterns

* Removed GCOM cache

* Renamed Detect to DetectAngular and Detector to AngularDetector

* Fix call to NewGCOMDetectorsProvider in newDynamicInspector

* Removed unused test function newError500GCOMScenario

* Added angularinspector service definition in pluginsintegration

* Moved dynamic inspector into pluginsintegration

* Move gcom angulardetectorsprovider into pluginsintegration

* Log errUnknownPatternType at debug level

* re-generate feature flags

* fix error log
2023-06-26 15:33:21 +02:00
Will Browne
624777258b
Plugins: Refactor creation of plugin context to dedicated service (#66451)
* first pass

* fix tests

* return errs

* change signature

* tidy

* delete unnecessary fields from test

* tidy

* fix tests

* simplify

* separate error check in API

* apply nits
2023-06-08 13:59:51 +02:00
Giuseppe Guerra
f148b5fb28
Plugins: Forbid loading Angular plugins when Angular is disabled (#69679)
* Plugins: Forbid loading Angular plugins when Angular is disabled

* Plugins: Made angulardetector a service, add tests for angular loader cases

* Fix missing import

* Add nolint:gocyclo to loadPlugins
2023-06-07 11:08:01 +02:00
Giuseppe Guerra
7a132680ef
Revert "Plugins: Forbid loading Angular plugins when Angular is disabled (#69225)" (#69657)
This reverts commit ff34279ff4.
2023-06-06 18:09:41 +02:00
Giuseppe Guerra
ff34279ff4
Plugins: Forbid loading Angular plugins when Angular is disabled (#69225)
* Plugins: Forbid loading Angular plugins when Angular is disabled

* Plugins: Made angulardetector a service, add tests for angular loader cases

* Fix missing import
2023-06-06 17:14:31 +02:00
Marcus Efraimsson
dcc1169ab2
Chore: Remove unused code/dependencies in testdata datasource (#69386) 2023-06-05 11:34:02 +02:00
Marcus Efraimsson
4cbda914bd
Plugins: Refactor call resource API handling (#67234)
Moving call resource API stream handling within plugin management as a utility/wrapper. 

Closes #66889

Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>
2023-04-28 14:02:27 +02:00
Andres Martinez Gotor
aa9838bd25
Chore: Refactor manifest verifier (#67218) 2023-04-27 17:54:28 +02:00
Giuseppe Guerra
bfe1b68800
Plugins: Fs: Add option to access unallowed files in dev mode (#66492)
* Plugins: Fs: Add option to access unallowed files in dev mode

* Plugins: Fs: allow accessing unallowed files only when in dev mode

* Plugins: Fs: Add ProvideLocalFinder

* Plugins: FS: Pass whole config in NewLocalFinder()

* Plugins: FS: Add AllowListLocalFS

* Plugins: FS: Fix some tests

* Plugins: FS: Update tests

* Plugins: FS: Removed dead code

* Plugins: FS: Add tests for AllowListFS

* Plugins: FS: Update comments

* Plugins: FS: Use variadic arguments for allow list rather than map

* Plugins: FS: Remove unnecessary log

* Plugins: FS: Do not escape plugin root dir

* Fix merge conflict

* Plugins: FS: Update comments

* Plugins: FS: PR review changes

* Fix merge conflict

* Fix tests

* Cleanup

* Fix flaky test

* Changes from PR review

* Lint

* Add comment to LocalFS.Remove

* Fix Windows

* Renamed devMode to production
2023-04-27 10:26:15 +02:00
Andres Martinez Gotor
9d7c3a101d
Chore: Use KVStore for the manifest public key (#66839) 2023-04-25 13:01:49 +02:00
Michael Mandrus
a29cfe5d46
Caching: Consolidate resource cache checking and updating in plugin middleware (#67002)
* Update the HandleResourceRequest function to mimic the HandleQueryRequest function

* Remove CacheResourceResponse function from interface

* revert additional thing I missed
2023-04-21 13:03:49 -04:00
Andres Martinez Gotor
98c695c68f
Chore: Use Grafana API to retrieve the public key to validate plugins (#66439) 2023-04-18 16:12:05 +02:00