*: fix security issues - Githubissues

pingcap / tidb-dashboard

A Web UI for monitoring, diagnosing and managing the TiDB cluster.

https://docs.pingcap.com/tidb/stable/dashboard-intro

Apache License 2.0

176 stars 134 forks source link

*: fix security issues #1731

Open mornyx opened 2 months ago

mornyx commented 2 months ago

This PR fixes some security issues.

Use of inherently dangerous function in pkg/apiserver/logsearch/task.go.
Potential SQL injection in pkg/apiserver/statement/queries.go. (In reality, only SQL digests are concatenated, so this won’t happen, but it’s there to prevent “potential changes”.)
External service interaction via DNS in pkg/apiserver/logsearch.
Lack of rate limiting on unauthed API /api/user/login.

ti-chi-bot[bot] commented 2 months ago

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Once this PR has been reviewed and has the lgtm label, please assign breezewish for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files: - **[OWNERS](https://github.com/pingcap/tidb-dashboard/blob/master/OWNERS)** Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment