Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: add endpoint verification in debugapi to avoid ssrf #1564

Merged
merged 7 commits into from
Jul 31, 2023
Merged

fix: add endpoint verification in debugapi to avoid ssrf #1564

merged 7 commits into from
Jul 31, 2023

Conversation

mornyx
Copy link
Collaborator

@mornyx mornyx commented Jul 25, 2023

Signed-off-by: mornyx mornyx.z@gmail.com

@mornyx
fix: add endpoint verification in debugapi to avoid ssrf
607a942 
Signed-off-by: mornyx <mornyx.z@gmail.com>
@ti-chi-bot ti-chi-bot bot requested a review from Renkai July 25, 2023 07:40
@netlify
Copy link

netlify bot commented Jul 25, 2023 •
edited
Loading

❌ Deploy Preview for tidb-dashboard-for-dbaas failed.

Name Link
🔨 Latest commit 16341ce
🔍 Latest deploy log https://app.netlify.com/sites/tidb-dashboard-for-dbaas/deploys/64c75b89dc092b000831cad3

@netlify
Copy link

netlify bot commented Jul 25, 2023 •
edited
Loading

❌ Deploy Preview for tidb-dashboard failed.

Name Link
🔨 Latest commit 16341ce
🔍 Latest deploy log https://app.netlify.com/sites/tidb-dashboard/deploys/64c75b893803b40008810a1f

@ti-chi-bot ti-chi-bot bot added the size/L label Jul 25, 2023
@codecov
Copy link

codecov bot commented Jul 25, 2023 •
edited
Loading

Codecov Report

Merging #1564 (16341ce) into master (199fede) will decrease coverage by 0.06%.
The diff coverage is 5.17%.

Additional details and impacted files 
@@            Coverage Diff             @@
##           master    #1564      +/-   ##
==========================================
- Coverage   24.80%   24.75%   -0.06%     
==========================================
  Files         168      168              
  Lines       15003    15059      +56     
==========================================
+ Hits         3722     3728       +6     
- Misses      11007    11057      +50     
  Partials      274      274
Flag Coverage Δ
backend_integration 9.18% <3.44%> (+0.09%) ⬆️
backend_ut 26.64% <1.81%> (-0.14%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 199fede...16341ce. Read the comment docs.

@ti-chi-bot ti-chi-bot bot removed the lgtm label Jul 28, 2023
@baurine baurine added this pull request to the merge queue Jul 28, 2023
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to no response for status checks Jul 28, 2023
@mornyx mornyx enabled auto-merge July 31, 2023 05:28
@ti-chi-bot ti-chi-bot bot added the lgtm label Jul 31, 2023
@mornyx mornyx added this pull request to the merge queue Jul 31, 2023
@ti-chi-bot ti-chi-bot bot removed the lgtm label Jul 31, 2023
@ti-chi-bot
Copy link
Contributor

ti-chi-bot bot commented Jul 31, 2023

@mornyx: Your PR was out of date, I have automatically updated it for you.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository.

@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to no response for status checks Jul 31, 2023
@mornyx mornyx enabled auto-merge July 31, 2023 08:13
@mornyx mornyx added this pull request to the merge queue Jul 31, 2023
@ti-chi-bot ti-chi-bot bot added the lgtm label Jul 31, 2023
@ti-chi-bot
Copy link
Contributor

ti-chi-bot bot commented Jul 31, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: baurine, shhdgit

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@ti-chi-bot
Copy link
Contributor

ti-chi-bot bot commented Jul 31, 2023

[LGTM Timeline notifier]

Timeline:

  • 2023-07-27 03:39:19.127801716 +0000 UTC m=+412101.722332689: ☑️ agreed by shhdgit.
  • 2023-07-28 03:59:56.323802875 +0000 UTC m=+499738.918333863: ✖️🔁 reset by mornyx.
  • 2023-07-31 05:30:38.253556146 +0000 UTC m=+76922.195904677: ☑️ agreed by baurine.
  • 2023-07-31 06:29:46.671927144 +0000 UTC m=+80470.614275675: ✖️🔁 reset by ti-chi-bot[bot].
  • 2023-07-31 08:52:21.27714224 +0000 UTC m=+89025.219490771: ☑️ agreed by baurine.

@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to no response for status checks Jul 31, 2023
@ti-chi-bot ti-chi-bot bot merged commit 9db0244 into pingcap:master Jul 31, 2023
5 of 18 checks passed
@mornyx mornyx deleted the debugapi-ssrf branch July 31, 2023 10:45
baurine pushed a commit that referenced this pull request Aug 15, 2023
@mornyx @baurine
fix: add endpoint verification in debugapi to avoid ssrf (#1564)
9cc7bc3
baurine pushed a commit that referenced this pull request Aug 16, 2023
@mornyx @baurine
fix: add endpoint verification in debugapi to avoid ssrf (#1564)
c3f3d59
baurine added a commit that referenced this pull request Aug 16, 2023
@baurine @mornyx
Release v2023.08.15.1 [skip pd_pr] (#1572)
e641463 
* chore: fix prometheus typo (#1558)

* fix(manual-profiling): fix crash caused by undefined filed `raw_data_type` (#1559)

* chore: remove slow query v2 pages (#1530)

* chore: remove slow query v2 pages

* chore: remove @antv/g2plot dep

* tweak: allows custom names to pass tls verification (#1562)

* tweak: allows prom addr with http path (#1563)

* fix: add endpoint verification in debugapi to avoid ssrf (#1564)

* feat: allows ngm timeout to be configured (#1569)

* fix(statements): fix download statements failed issue

* update version to 2023.08.15.1

---------

Co-authored-by: Yexiang Zhang <mornyx.z@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@baurine baurine baurine approved these changes

@shhdgit shhdgit shhdgit approved these changes

@Renkai Renkai Awaiting requested review from Renkai

Assignees
No one assigned
Labels
approved lgtm size/L
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@mornyx @baurine @shhdgit