[Patch] Graphite SSRF patch

[ananzh]

Signed-off-by: Anan Zhuang ananzh@amazon.com

Description

This PR is an implementation of ssrf patch. This patch allows customers to choose allowlist (vis_type_timeline.graphiteUrls) or blocklist (vis_type_timeline.blocklist) or both to verify its users' graphite url inputs. Customers can simply enable or disable these settings in the opensearch_dashboards.yml file to control what method they would like to apply for the safety check.

Only allowlist

• Advanced setting: timeline:graphite.url: the first url in the allowlist is shown as the default setting in the text box. For example, vis_type_timeline.graphiteUrls: ['https://www.hostedgraphite.com/UID/ACCESS_KEY/graphite']
• User enter url: The input url is checked by allowlist
  • url is in the allowlist: okay
  • url is not in the allowlist: error message

Only blocklist

• Advanced setting: timeline:graphite.url: empty text box. For example, vis_type_timeline.blocklist: ['127.0.0.0/8']
• User enter url: The input url is checked by blocklist
  • url is not in the blocklist: okay
  • url is in the allowlist: error message

Both blocklist and allowlist

• Advanced setting: timeline:graphite.url: the first url in the allowlist is shown as the default setting in the text box. For example, vis_type_timeline.graphiteUrls: ['https://www.hostedgraphite.com/UID/ACCESS_KEY/graphite'] and vis_type_timeline.blocklist: ['127.0.0.0/8']
• User enter url: The input url is checked by blocklist
  • url is not in the blocklist: okay
  • url is in the allowlist: error message

Neither blocklist nor allowlist

• Advanced setting: timeline:graphite.url: empty text box
• User enter url: error message asking user to configure

Notice

This PR doesn't implement the proposed combined UI component which is a text box that allows for a drop down menu as well due to the following considerations:

• First, customer's allowlist might contain several users accessible urls. Advanced setting timeline:graphite.url should be a place for user to enter his/her own url to get access check. It should not expose other users' urls.
• Second, if customer has users with similar but long graphite url, dropdown list could not display the complete url which will cause usage pain:
• Third, if customer has many users, drop down will be too long and users might take a while to search the drop menu.

Therefore, a simple text box is enough for user to input his/her own graphite url. If this part needs further discussion, a separate PR could be opened since this would not affect security and would just be a UI component change.

Issues Resolved

#331

Instruction to recreate the issue

• code base configuration: config the settings vis_type_timeline.graphiteAllowedUrls and vis_type_timeline.graphiteBlockedIPs (pick one or both) in opensearch_dashboards.yml in config folder
• open dashboards and go to stack Management
• click Advanced Settings and find Timeline section
• configure the url in Graphite URL text box
• back to Home menu and go to visualize
• click create visualization then click timeline
• at Timeline expression use graphite function: .graphite(1) (1 is the passed parameter. just an example)

Check List

• New functionality includes testing.
  • All tests pass
• New functionality has been documented.
  • New functionality has javadoc added
• Commits are signed per the DCO using --signoff

[opensearch-ci-bot]

✅   DCO Check Passed 63598eb

[seraphjiang]

Do we have readme or doc for all supported config/settings. If not, could we add the example config for (blocklist) into opensearch_dashboards.yml

[ananzh]

Do we have readme or doc for all supported config/settings. If not, could we add the example config for (blocklist) into opensearch_dashboards.yml

will do

[opensearch-ci-bot]

✅   DCO Check Passed 63598eb

[opensearch-ci-bot]

✅   DCO Check Passed 39f183f

[opensearch-ci-bot]

✅   DCO Check Passed 36a6a1c

[opensearch-ci-bot]

✅   DCO Check Passed 68b0db0

[boktorbb]

Do we have readme or doc for all supported config/settings. If not, could we add the example config for (blocklist) into opensearch_dashboards.yml

I agree. We should have a description in the opensearch_dashboards.yml file but we should have more detailed documentation covering settings combinations and usage in the README.md in the plugin directory itself

[opensearch-ci-bot]

✅   DCO Check Passed 461ef9a

[opensearch-ci-bot]

✅   DCO Check Passed ec28338

[opensearch-ci-bot]

✅   DCO Check Passed 504c96c

[seraphjiang]

LGTM

[kavilla]

Only comment related to typo needs to be addressed, some nitpicks but works nicely!

I specifically ensured the backwards compatibility was still working as expected. Nothing to worry about there!

Thanks!

[opensearch-ci-bot]

✅   DCO Check Passed def813d

[opensearch-ci-bot]

✅   DCO Check Passed 1036bf2

[kavilla]

LGTM!

[boktorbb]

Looks good. Thanks!