fix(storage): remove dead DelegateRequest to resolve CodeQL SSRF alert#228
Merged
Conversation
DelegateRequest and its helper mapURL were never called from production code — the intended caller (forwardRequest) was commented out at introduction in 2017 and deleted in 2019. Removing them eliminates the taint flow that CodeQL alert #15 (go/request-forgery) tracks, since no user-controlled URL now reaches sendToPrometheus.
notque
requested review from
Kuckkuck,
LeoZhangZXZ,
ashifnihalb,
ibakshay,
joluc,
notandy,
olandr,
richardtief,
timojohlo,
trouaux and
viennaa
as code owners
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request removes long-dead Prometheus storage client request-forwarding code (DelegateRequest and mapURL) to eliminate a persistent CodeQL go/request-forgery (SSRF) alert path, while keeping the remaining Prometheus calls routed through buildURL() and sendToPrometheus().
Changes:
- Removed
(*prometheusStorageClient).DelegateRequest()and helpermapURL()as unused dead code. - Updated
sendToPrometheus()comment to reflect the intended URL construction flow and retained a genericmethodparameter with//nolint:unparam. - Removed
DelegateRequestfrom thestorage.Driverinterface.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| pkg/storage/prometheus.go | Drops DelegateRequest/mapURL and updates sendToPrometheus documentation + lint suppression. |
| pkg/storage/interface.go | Removes DelegateRequest from the Driver interface to match the implementation cleanup. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Merging this branch will increase overall coverage
Coverage by fileChanged files (no unit tests)
Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
DelegateRequestmethod and its helpermapURL— dead code since 2019 that triggers CodeQL alert Catalog discovery #15 (go/request-forgery)sendToPrometheuscomment to reflect that all callers now usebuildURL()exclusively//nolint:unparamformethodparameter (always "GET" now that the only non-GET caller is gone)Context
CodeQL's
go/request-forgeryrule tracks taint fromDelegateRequest's*http.Requestparameter throughmapURL()→sendToPrometheus()→httpClient.Do(). The previous fix (PR #227) added runtime host validation, but CodeQL doesn't recognize custom validators as sanitizers — the alert persisted.DelegateRequestwas introduced in 2017 (PR #19) for a generic request-forwarding handler (forwardRequest) that was committed already commented out and deleted in 2019. It has zero callers — all API endpoints use the typed methods (Query,QueryRange,Series, etc.) viabuildURL().Verification
make checkpasses (tests, golangci-lint, license, build)DelegateRequestTest plan
make checkpasses locally