Enviroment Provider Fails on Special Characters

[iveelsm]

What happened?

When using the env provider ($__env{EXAMPLE}) the resulting value is incorrectly parsed when some special characters are in use, namely: # and ;. This is highlighted in the database configuration as causing potential problems here:

# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""

I attempted with both:

password: $__env{ENV_PASSWORD}

and a triple quote:

password: """$__env{ENV_PASSWORD}"""

The triple quote seems to cause more issues as it won't actually recognize the value in that case it seems like. This is remedied by changing the value to something that does not contain those special characters.

What did you expect to happen?

I expected that I would either be able to use the env provider with the special characters, or work around it using the documented workaround. However, it seems that neither are the case.

Did this work before?

No.

How do we reproduce it?

1. Set up a database user that has a password with special characters like # or ;
2. Attempt to connect grafana to that database instance using the env provider for the password

Is the bug inside a dashboard panel?

No response

Environment (with versions)?

Grafana: 10.4.1
OS: N/A
Browser: N/A

Grafana platform?

Kubernetes

Datasource(s)?

No response

[tonypowa]

Hi @iveelsm
Thank you for creating this issue
Can you try to reproduce it in a more recent version of Grafana that we can support (last two mayor versions) ?
Thank you

[iveelsm]

@tonypowa Absolutely, but I am on vacation for the next week, so I will get back to you

In hindsight, I am realizing I actually posted the wrong version. I was looking at the helm chart version. The Grafana version is 10.4.1

My apologies.

[iveelsm]

@tonypowa Updated the version since I was looking at the wrong version when I opened this

[tonypowa]

Thanks for your reply
One last question, are you using Grafana's default db or are you using a different one (e.g. postgresql )
The issue is being routed to a engineering team for review

[iveelsm]

Postgres, external. :)

[kasimeka]

I added this to my helm values to work around the issue for database.password

grafana.ini:
  database:
    type: mysql
    name: grafana
    host: ${DB_HOSTNAME}
    user: ${DB_USERNAME}

envFromSecrets:
- name: grafana-db-secret
env:
  DB_HOSTNAME: <my not so secret db hostname>
  GF_PATHS_CONFIG: /etc/grafana.patched/grafana.ini
extraInitContainers:
  - name: inject-database-password
    image: busybox:musl
    command: ["sh", "-c"]
    args:
    - |
      sed "/^\[database\]$/a\password = $DB_PASSWORD" \
        /etc/grafana/grafana.ini \
        > /etc/grafana.patched/grafana.ini
    volumeMounts:
    - name: config
      mountPath: /etc/grafana/grafana.ini
      subPath: grafana.ini
    - name: config-patched
      mountPath: /etc/grafana.patched/
      readOnly: false
    envFrom:
    - secretRef:
        name: grafana-db-secret
extraVolumes:
  - name: config-patched
    emptyDir:
      sizeLimit: 5Mi
extraVolumeMounts:
  - name: config-patched
    mountPath: /etc/grafana.patched/
    readOnly: true