Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security: Sync security changes on main #45083

Merged
merged 15 commits into from Feb 9, 2022
Merged

Security: Sync security changes on main #45083

merged 15 commits into from Feb 9, 2022

Conversation

dsotirakis
Copy link
Contributor

@dsotirakis dsotirakis commented Feb 8, 2022 •
edited

What this PR does / why we need it:

Security fixes:

  • Security: Fixes CVE-2022-21702. For more information, see our blog
  • Security: Fixes CVE-2022-21703. For more information, see our blog
  • Security: Fixes CVE-2022-21713. For more information, see our blog

kminehart and others added 12 commits January 24, 2022 15:32
@kminehart @DanCech
* Teams: Appropriately apply user id filter in /api/teams/:id and /ap…
254f19c 
…i/teams/search

* Teams: Ensure that users searching for teams are only able see teams they have access to
* Teams: Require teamGuardian admin privileges to list team members
* Teams: Prevent org viewers from administering teams
* Teams: Add org_id condition to team count query
* Teams: clarify permission requirements in teams api docs
* Teams: expand scenarios for team search tests
* Teams: mock teamGuardian in tests

Co-authored-by: Dan Cech <dcech@grafana.com>
@kminehart
remove duplicate WHERE statement
190cf95
@marefr @dsotirakis
Fix for CVE-2022-21702
160a600 
(cherry picked from commit 202d7c190082c094bc1dc13f7fe9464746c37f9e)
@marefr @dsotirakis
Lint and test fixes
aaff1bb 
(cherry picked from commit 3e6b67d5504abf4a1d7b8d621f04d062c048e981)
@zserge @dsotirakis
check content type properly
8dffad9 
(cherry picked from commit 70b4458892bf2f776302720c10d24c9ff34edd98)
@zserge @dsotirakis
basic csrf origin check
27751ae 
(cherry picked from commit 3adaa5ff39832364f6390881fb5b42ad47df92e1)
@zserge @dsotirakis
compare origin to host
1e20d40 
(cherry picked from commit 5443892699e8ed42836bb2b9a44744ff3e970f42)
@zserge @dsotirakis
simplify url parsing
14bbff6 
(cherry picked from commit b2ffbc9513fed75468628370a48b929d30af2b1d)
@zserge @dsotirakis
check csrf for GET requests, only compare origin
f0caad2 
(cherry picked from commit 8b81dc12d8f8a1f07852809c5b4d44f0f0b1d709)
@zserge @dsotirakis
parse content type properly
d33b31e 
(cherry picked from commit 16f76f4902e6f2188bea9606c68b551af186bdc0)
@zserge @dsotirakis
mentioned get in the comment
6b8cc89 
(cherry picked from commit a7e61811ef8ae558ce721e2e3fed04ce7a5a5345)
@kminehart
resolve conflicts
97f6b96
@dsotirakis dsotirakis added the backport v8.4.x Mark PR for automatic backport to v8.4.x label Feb 8, 2022
@dsotirakis dsotirakis added this to the 8.4.0 milestone Feb 8, 2022
@dsotirakis dsotirakis self-assigned this Feb 8, 2022
This was referenced Feb 8, 2022
Closed
Closed
@vtorosyan vtorosyan marked this pull request as ready for review February 9, 2022 12:04
@vtorosyan vtorosyan requested review from pkolyvas and a team as code owners February 9, 2022 12:04
@vtorosyan vtorosyan requested review from kminehart and removed request for a team February 9, 2022 12:04
marefr
marefr approved these changes Feb 9, 2022
View reviewed changes
Copy link
Member

@marefr marefr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@vtorosyan vtorosyan merged commit 605d056 into main Feb 9, 2022
@vtorosyan vtorosyan deleted the security-fixes-main branch February 9, 2022 12:44
@grafanabot
Copy link
Contributor

The backport to v8.4.x failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new branch
git switch --create backport-45083-to-v8.4.x origin/v8.4.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x 605d056136b3dce5545bdbd7868acd8778eed9b1
# Push it to GitHub
git push --set-upstream origin backport-45083-to-v8.4.x
git switch main
# Remove the local backport branch
git branch -D backport-45083-to-v8.4.x

Then, create a pull request where the base branch is v8.4.x and the compare/head branch is backport-45083-to-v8.4.x.

vtorosyan pushed a commit that referenced this pull request Feb 9, 2022
@dsotirakis @vtorosyan
Security: Sync security changes on main (#45083)
4b118c1 
* * Teams: Appropriately apply user id filter in /api/teams/:id and /api/teams/search
* Teams: Ensure that users searching for teams are only able see teams they have access to
* Teams: Require teamGuardian admin privileges to list team members
* Teams: Prevent org viewers from administering teams
* Teams: Add org_id condition to team count query
* Teams: clarify permission requirements in teams api docs
* Teams: expand scenarios for team search tests
* Teams: mock teamGuardian in tests

Co-authored-by: Dan Cech <dcech@grafana.com>

* remove duplicate WHERE statement

* Fix for CVE-2022-21702

(cherry picked from commit 202d7c190082c094bc1dc13f7fe9464746c37f9e)

* Lint and test fixes

(cherry picked from commit 3e6b67d5504abf4a1d7b8d621f04d062c048e981)

* check content type properly

(cherry picked from commit 70b4458892bf2f776302720c10d24c9ff34edd98)

* basic csrf origin check

(cherry picked from commit 3adaa5ff39832364f6390881fb5b42ad47df92e1)

* compare origin to host

(cherry picked from commit 5443892699e8ed42836bb2b9a44744ff3e970f42)

* simplify url parsing

(cherry picked from commit b2ffbc9513fed75468628370a48b929d30af2b1d)

* check csrf for GET requests, only compare origin

(cherry picked from commit 8b81dc12d8f8a1f07852809c5b4d44f0f0b1d709)

* parse content type properly

(cherry picked from commit 16f76f4902e6f2188bea9606c68b551af186bdc0)

* mentioned get in the comment

(cherry picked from commit a7e61811ef8ae558ce721e2e3fed04ce7a5a5345)

* add content-type: application/json to test HTTP requests

* fix pluginproxy test

* Fix linter when comparing errors

Co-authored-by: Kevin Minehart <kmineh0151@gmail.com>
Co-authored-by: Dan Cech <dcech@grafana.com>
Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>
Co-authored-by: Serge Zaitsev <serge.zaitsev@grafana.com>
Co-authored-by: Vardan Torosyan <vardants@gmail.com>
(cherry picked from commit 605d056)
@vtorosyan vtorosyan mentioned this pull request Feb 9, 2022
Merged
vtorosyan added a commit that referenced this pull request Feb 9, 2022
@vtorosyan @dsotirakis
@marefr @Jguer
Security: Sync security changes on main (#45083) (#45140)
ff8e53a 
* Security: Sync security changes on main (#45083)

* * Teams: Appropriately apply user id filter in /api/teams/:id and /api/teams/search
* Teams: Ensure that users searching for teams are only able see teams they have access to
* Teams: Require teamGuardian admin privileges to list team members
* Teams: Prevent org viewers from administering teams
* Teams: Add org_id condition to team count query
* Teams: clarify permission requirements in teams api docs
* Teams: expand scenarios for team search tests
* Teams: mock teamGuardian in tests

Co-authored-by: Dan Cech <dcech@grafana.com>

* remove duplicate WHERE statement

* Fix for CVE-2022-21702

(cherry picked from commit 202d7c190082c094bc1dc13f7fe9464746c37f9e)

* Lint and test fixes

(cherry picked from commit 3e6b67d5504abf4a1d7b8d621f04d062c048e981)

* check content type properly

(cherry picked from commit 70b4458892bf2f776302720c10d24c9ff34edd98)

* basic csrf origin check

(cherry picked from commit 3adaa5ff39832364f6390881fb5b42ad47df92e1)

* compare origin to host

(cherry picked from commit 5443892699e8ed42836bb2b9a44744ff3e970f42)

* simplify url parsing

(cherry picked from commit b2ffbc9513fed75468628370a48b929d30af2b1d)

* check csrf for GET requests, only compare origin

(cherry picked from commit 8b81dc12d8f8a1f07852809c5b4d44f0f0b1d709)

* parse content type properly

(cherry picked from commit 16f76f4902e6f2188bea9606c68b551af186bdc0)

* mentioned get in the comment

(cherry picked from commit a7e61811ef8ae558ce721e2e3fed04ce7a5a5345)

* add content-type: application/json to test HTTP requests

* fix pluginproxy test

* Fix linter when comparing errors

Co-authored-by: Kevin Minehart <kmineh0151@gmail.com>
Co-authored-by: Dan Cech <dcech@grafana.com>
Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>
Co-authored-by: Serge Zaitsev <serge.zaitsev@grafana.com>
Co-authored-by: Vardan Torosyan <vardants@gmail.com>
(cherry picked from commit 605d056)

* Apply suggestions from code review

* remove uneeded test fix from patch

Co-authored-by: Dimitris Sotirakis <sotirakis.dim@gmail.com>
Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>
Co-authored-by: jguer <joao.guerreiro@grafana.com>
ryantxu pushed a commit that referenced this pull request Feb 9, 2022
@dsotirakis @kminehart
@DanCech @marefr @zserge @vtorosyan @ryantxu
Security: Sync security changes on main (#45083)
c84ac0d 
* * Teams: Appropriately apply user id filter in /api/teams/:id and /api/teams/search
* Teams: Ensure that users searching for teams are only able see teams they have access to
* Teams: Require teamGuardian admin privileges to list team members
* Teams: Prevent org viewers from administering teams
* Teams: Add org_id condition to team count query
* Teams: clarify permission requirements in teams api docs
* Teams: expand scenarios for team search tests
* Teams: mock teamGuardian in tests

Co-authored-by: Dan Cech <dcech@grafana.com>

* remove duplicate WHERE statement

* Fix for CVE-2022-21702

(cherry picked from commit 202d7c190082c094bc1dc13f7fe9464746c37f9e)

* Lint and test fixes

(cherry picked from commit 3e6b67d5504abf4a1d7b8d621f04d062c048e981)

* check content type properly

(cherry picked from commit 70b4458892bf2f776302720c10d24c9ff34edd98)

* basic csrf origin check

(cherry picked from commit 3adaa5ff39832364f6390881fb5b42ad47df92e1)

* compare origin to host

(cherry picked from commit 5443892699e8ed42836bb2b9a44744ff3e970f42)

* simplify url parsing

(cherry picked from commit b2ffbc9513fed75468628370a48b929d30af2b1d)

* check csrf for GET requests, only compare origin

(cherry picked from commit 8b81dc12d8f8a1f07852809c5b4d44f0f0b1d709)

* parse content type properly

(cherry picked from commit 16f76f4902e6f2188bea9606c68b551af186bdc0)

* mentioned get in the comment

(cherry picked from commit a7e61811ef8ae558ce721e2e3fed04ce7a5a5345)

* add content-type: application/json to test HTTP requests

* fix pluginproxy test

* Fix linter when comparing errors

Co-authored-by: Kevin Minehart <kmineh0151@gmail.com>
Co-authored-by: Dan Cech <dcech@grafana.com>
Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>
Co-authored-by: Serge Zaitsev <serge.zaitsev@grafana.com>
Co-authored-by: Vardan Torosyan <vardants@gmail.com>
@IevaVasiljeva IevaVasiljeva mentioned this pull request Feb 15, 2022
Merged
This was referenced Mar 1, 2022
Open
Open
alexweav pushed a commit that referenced this pull request Mar 3, 2022
@dsotirakis @kminehart
@DanCech @marefr @zserge @vtorosyan @alexweav
Security: Sync security changes on main (#45083)
31e1cc1 
* * Teams: Appropriately apply user id filter in /api/teams/:id and /api/teams/search
* Teams: Ensure that users searching for teams are only able see teams they have access to
* Teams: Require teamGuardian admin privileges to list team members
* Teams: Prevent org viewers from administering teams
* Teams: Add org_id condition to team count query
* Teams: clarify permission requirements in teams api docs
* Teams: expand scenarios for team search tests
* Teams: mock teamGuardian in tests

Co-authored-by: Dan Cech <dcech@grafana.com>

* remove duplicate WHERE statement

* Fix for CVE-2022-21702

(cherry picked from commit 202d7c190082c094bc1dc13f7fe9464746c37f9e)

* Lint and test fixes

(cherry picked from commit 3e6b67d5504abf4a1d7b8d621f04d062c048e981)

* check content type properly

(cherry picked from commit 70b4458892bf2f776302720c10d24c9ff34edd98)

* basic csrf origin check

(cherry picked from commit 3adaa5ff39832364f6390881fb5b42ad47df92e1)

* compare origin to host

(cherry picked from commit 5443892699e8ed42836bb2b9a44744ff3e970f42)

* simplify url parsing

(cherry picked from commit b2ffbc9513fed75468628370a48b929d30af2b1d)

* check csrf for GET requests, only compare origin

(cherry picked from commit 8b81dc12d8f8a1f07852809c5b4d44f0f0b1d709)

* parse content type properly

(cherry picked from commit 16f76f4902e6f2188bea9606c68b551af186bdc0)

* mentioned get in the comment

(cherry picked from commit a7e61811ef8ae558ce721e2e3fed04ce7a5a5345)

* add content-type: application/json to test HTTP requests

* fix pluginproxy test

* Fix linter when comparing errors

Co-authored-by: Kevin Minehart <kmineh0151@gmail.com>
Co-authored-by: Dan Cech <dcech@grafana.com>
Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>
Co-authored-by: Serge Zaitsev <serge.zaitsev@grafana.com>
Co-authored-by: Vardan Torosyan <vardants@gmail.com>
@marefr marefr mentioned this pull request Mar 11, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@marefr marefr marefr approved these changes

@pkolyvas pkolyvas Awaiting requested review from pkolyvas

@kminehart kminehart Awaiting requested review from kminehart kminehart was automatically assigned from grafana/backend-platform

@idafurjes idafurjes Awaiting requested review from idafurjes idafurjes was automatically assigned from grafana/backend-platform

@malcolmholmes malcolmholmes Awaiting requested review from malcolmholmes malcolmholmes was automatically assigned from grafana/backend-platform

@osg-grafana osg-grafana Awaiting requested review from osg-grafana osg-grafana was automatically assigned from grafana/docs-squad

@KMiller-Grafana KMiller-Grafana Awaiting requested review from KMiller-Grafana KMiller-Grafana was automatically assigned from grafana/docs-squad

@wbrowne wbrowne Awaiting requested review from wbrowne wbrowne is a code owner automatically assigned from grafana/plugins-platform-backend

@axelavargas axelavargas Awaiting requested review from axelavargas axelavargas was automatically assigned from grafana/grafana-frontend-platform

@ashharrison90 ashharrison90 Awaiting requested review from ashharrison90 ashharrison90 was automatically assigned from grafana/grafana-frontend-platform

Assignees

@dsotirakis dsotirakis

Labels
area/backend backport v8.4.x Mark PR for automatic backport to v8.4.x type/docs
Projects
None yet
Milestone
8.4.0
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@dsotirakis @grafanabot @marefr @vtorosyan @kminehart @zserge