Commit graph

9 commits

Author SHA1 Message Date
Kyle Brandt
63e493cc26
expr/sql: enable SQL trace redaction for server-side expressions (#126168)
* expr/sql: enable SQL trace redaction for server-side expressions

Bumps the go-mysql-server fork to a build that includes the merged
upstream opt-in SQL trace redaction (dolthub/go-mysql-server#3537) and
opts the SSE SQL context into it via WithTraceRedaction(true).

GMS trace span attributes (the planbuilder "query" attr and the rowexec
"table"/"left"/"right" attrs) carry the user's SQL verbatim, including
table identifiers and literal filter values. With redaction enabled,
identifiers become stable tokens (n1, n2, ...) and literals become value
tokens ('v1', :v2, ...), deduped per query

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-11 14:54:41 +00:00
Mariell Hoversholm
0e5d9e01ef
Security: Fix CVE-2026-27876, CVE-2026-27877, CVE-2026-28375, CVE-2026-27879, CVE-2026-27880 (#121514)
* patch(security): FrontendSettings: Only include used data sources for public dashboards

GL-Vuln: VUL-2026-0023 https://ops.grafana-ops.net/a/grafana-vulnerabilityobs-app/first-party/55
GL-Partner-Ack: 2026-02-25T14:02:00Z

* patch(security): patch(security): block INTO clauses in SQL expression allowlist

GL-Vuln: VUL-2026-0025 https://ops.grafana-ops.net/a/grafana-vulnerabilityobs-app/first-party/57
GL-Partner-Ack: 2026-02-24T13:35:00Z

* patch(security): fix(testdata): limit scenario data points

GL-Vuln: VUL-2026-0028 https://ops.grafana-ops.net/a/grafana-vulnerabilityobs-app/first-party/60
GL-Partner-Ack: 2026-02-25T14:02:00Z

* patch(security): Add a limit to the upsample size in mathexp.Resample

GL-Vuln: VUL-2026-0029 https://ops.grafana-ops.net/a/grafana-vulnerabilityobs-app/first-party/61
GL-Partner-Ack: 2026-02-25T14:02:00Z

* patch(security): security(expr/sql): disable file writes in SQL expression engine

GL-Vuln: VUL-2026-0025 https://ops.grafana-ops.net/a/grafana-vulnerabilityobs-app/first-party/57
GL-Partner-Ack: 2026-02-24T13:35:00Z

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Matheus Macabu <macabu.matheus@gmail.com>
2026-03-31 14:02:49 +02:00
Kyle Brandt
4f0cb47d3c
SQL Expressions: Rework backend errors and error instrumentation (#109633)
* Capture error_type label on metrics/traces
* Make error messages more helpful to user
* Use errutil, categorized errors, and tie them to error_type (category in code)
* Misc trace fixes
* Add metric to track SQL input conversion
2025-08-25 11:13:42 -04:00
Kyle Brandt
5e056c2a3f
SQL Expressions: Add sql expression specific timeout and output limit (#104834)
Adds settings for SQL expressions:
 sql_expression_cell_output_limit

Set the maximum number of cells that can be returned from a SQL expression. Default is 100000.

sql_expression_timeout

The duration a SQL expression will run before being cancelled. The default is 10s.
2025-05-13 15:22:20 -04:00
Kyle Brandt
6a6ba723a9
SQL Expressions: Add internal GMS traces (#104836)
get trace from inside GMS
2025-05-09 14:48:47 -04:00
Sam Jewell
d7aeebe5e3
Sql Expressions: State when error is from GMS (#102112) 2025-03-18 22:41:42 +00:00
Kyle Brandt
d64f41afdc
SQL Expressions: Re-implement feature using go-mysql-server (#99521)
* Under feature flag `sqlExpressions` and is experimental
* Excluded from arm32
* Will not work with the Query Service yet
* Does not have limits in place yet
* Does not working with alerting yet
* Currently requires "prepare time series" Transform for time series viz
 
---------

Co-authored-by: Sam Jewell <sam.jewell@grafana.com>
2025-02-06 07:27:28 -05:00
Sam Jewell
1915efbc95
SQL Expressions: Simplify where code is being stubbed out (#96227)
* Rename from DuckDB

* Remove unused function
2024-11-18 12:05:08 +00:00
Sam Jewell
ea71201ddc
ServerSideExpressions: Disable SQL Expressions to prevent RCE and LFI vulnerability (#94942)
* disable sql expressions

remove duckdb ref

* Run `make update-workspace`

---------

Co-authored-by: Scott Lepper <scott.lepper@gmail.com>
2024-10-18 11:28:26 +01:00