Skip to content

Not provide query results when testing Rule#614

Merged
vincent-olivert-riera merged 1 commit intoline:masterfrom
hoangpn:feature/test_query
Jun 17, 2025
Merged

Not provide query results when testing Rule#614
vincent-olivert-riera merged 1 commit intoline:masterfrom
hoangpn:feature/test_query

Conversation

@hoangpn
Copy link
Contributor

@hoangpn hoangpn commented Jun 17, 2025

From the Rule's edit page, users can write any query and execute with the test button. After that, the results are presented on the screen. The query is executed on all data sources, and for that Promgen provides the basic auth credentials configured in for each data source. This capability led to a potential security issue where users can run any query anonymously.

Therefore, we want to stop providing the query results to the user, and instead, just say if the rule would fire or not.

Not firing:
AS-IS:
image
TO-BE:
image

Firing:
AS-IS:
image
TO-BE:
image

@vincent-olivert-riera
Copy link
Contributor

@hoangpn , thanks for this. I have one request to make.

In the case of a "Not firing" alert rule, I think it does not make sense to show a table with no_results error. That table will always be the same in that case, and the "Not firing" state already indicates the query produced no results, so I think it would be better to just don't show that table in that case.

Could you please make that change? 🙇

Copy link
Contributor

@vincent-olivert-riera vincent-olivert-riera left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me.

Could you please rebase on master and squash all the fixups?

@hoangpn hoangpn force-pushed the feature/test_query branch from d92f70d to a2b01ce Compare June 17, 2025 08:39
From the Rule's edit page, users can write any query and execute with the test button.
After that, the results are presented on the screen. The query is executed on all data
sources, and for that Promgen provides the basic auth credentials configured in for
each data source. This capability led to a potential security issue where users can run
any query anonymously.

Therefore, we want to stop providing the query results to the user, and instead, just
say if the rule would fire or not.
@hoangpn hoangpn force-pushed the feature/test_query branch from a2b01ce to a983918 Compare June 17, 2025 08:40
@hoangpn
Copy link
Contributor Author

hoangpn commented Jun 17, 2025

@vincent-olivert-riera Thank you so much.
The PR is ready for the final review. 🙇

@vincent-olivert-riera vincent-olivert-riera merged commit 9358dbc into line:master Jun 17, 2025
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants