Denial of service by visiting a URL

[jschmidt-1]

By visiting a prepared link you can effectively overload the rendering machine, because the threads do not exit.

Expected Behavior

When visiting the prepared link it either should return a graph (probably a new feature) or gracefully exit with an error.

Current Behavior

It creates new rendering threads for each call. From the client side it results in a gateway timeout, but the rendering machine has lingering rendering threads which must be killed manually.

Steps to Reproduce (for bugs)

1. Have icinga2 and this grafana module configured in proxy mode and running, same for influxdb and grafana
2. Visit a link pointing to grafana/show, e.g. https://example.org/icingaweb2/grafana/show?host=$valid_hostname$&service=$invalid_service$
3. Revisit the link multiple times
4. Monitor client status and rendering threads, we see multiple chrome threads on the rendering machine hogging CPU time and memory

Context

I tried adding a graph to icinga2's dashboard without a real service behind so I explored the modules possibilities. This is still inconclusive, but unrelated to this issue. This attempt ended with an alert about load and memory consumption which required manual intervention. This seems to at least only be possible for logged in users.

Your Environment

New setup, everything is running on the same machine.

• Icinga Web 2 Grafana version (System - About): 1.3.6
• Icinga Web 2 version and modules (System - About):
  • icingaweb2 2.8.2
  • director 1.8.0
  • incubator 0.6.0
  • ipl 0.5.0
  • reactbundle 0.9.0
• Version used (icinga2 --version): r2.12.3-1
• Operating System and version: Ubuntu 18.04.5
• Enabled features (icinga2 feature list): api checker ido-mysql influxdb mainlog notification
• grafana-server: 7.4.3
  • Grafana Image Renderer: 2.0.1
• influxdb: 1.1.1 - go1.7.4

[Mikesch-mp]

Can't reproduce it. The load goes high because the user run (allowed by permission) to show all graphs of a host. running multible time will spawn a lot of chrome threads. but load goes down once all is rendered.