Skip to content

security.md

Latest commit

 

History

History
51 lines (38 loc) · 2.45 KB

security.md

File metadata and controls

51 lines (38 loc) · 2.45 KB
Raw

Security guide

This plugin is designed to pass Grafana's plugin security review. Controls are implemented in code (pkg/security, pkg/models) and verified by tests.

Threat model summary

Asset Threat Control
Access token Exposure to browser/logs/inspector Stored in secureJsonData; decrypted only in the backend; never serialized back (json:"-"); redacted from logs/errors
Engine endpoint SSRF / DNS rebinding / metadata theft security.ValidateOutboundHost blocks loopback/link-local/private/metadata; resolves and checks IPs
Transport MITM / downgrade TLS 1.2+ by default, custom CA support, explicit opt-in to skip verify
Query inspector / telemetry Secret leakage Only SQL, query id, and timings are surfaced; redaction applied to all error strings

Secret handling

  • The token and optional CA bundle live only in secureJsonData. Grafana sends the browser presence booleans (secureJsonFields), never the values.
  • security.Redactor masks known secret values and secret-shaped patterns (Authorization, password=, "accessToken":"…") in every log and error.
  • CheckHealth, resource responses, and frame.Meta carry no secret material.

SSRF protection (pkg/security/ssrf.go)

  • Cloud metadata endpoints (169.254.169.254, fd00:ec2::254, 100.100.100.200) are always blocked.
  • Loopback, link-local, private, unspecified, and multicast addresses are blocked unless the operator enables Allow private networks (for self-hosted clusters) — metadata endpoints stay blocked even then.
  • The host is resolved and every returned IP is validated, closing the DNS-rebinding hole. The resolver is injectable for testing.

TLS (pkg/security/tls.go)

  • Verification on by default; TLS 1.2 floor.
  • Custom CA bundle (PEM) appended to system roots.
  • CertExpiryWarning surfaces expired/expiring certificates (wired into health reporting as the verification path matures).

Input validation (pkg/models)

  • Host, port, identifiers (catalog/schema/cluster/database) are validated before any dial; control characters and overlong values are rejected, preventing injection into gRPC metadata headers.
  • SQL is sent to the engine as-is for the user's own query; dryRun powers the validate endpoint. Template variables are resolved client-side via Grafana's template service.

Reporting

See SECURITY.md for private vulnerability disclosure.