Skip to content

Return api server host and db host info from diagnostic endpt #1343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 14, 2023
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 22 additions & 4 deletions src/server/endpoints/admin.py
Original file line number Diff line number Diff line change
@@ -1,11 +1,13 @@
import json
from pathlib import Path
import socket
from typing import Dict, List, Set

from flask import Blueprint, make_response, render_template_string, request
from werkzeug.exceptions import NotFound, Unauthorized
from werkzeug.utils import redirect

from .._common import log_info_with_request
from .._common import db, log_info_with_request
from .._config import ADMIN_PASSWORD, API_KEY_REGISTRATION_FORM_LINK, API_KEY_REMOVAL_REQUEST_LINK, REGISTER_WEBHOOK_TOKEN
from .._db import WriteSession
from .._security import resolve_auth_token
Expand Down Expand Up @@ -130,6 +132,22 @@ def diags():
# such as a full current "X-Forwarded-For" path as inserted into headers by intermediate proxies...
# (but only when initiated purposefully by us to keep junk out of the logs)
_require_admin()
log_info_with_request("diagnostics", headers=request.headers)
response_text = f"request path: {request.headers.get('X-Forwarded-For', 'idk')}"
return make_response(response_text, 200, {'content-type': 'text/plain'})

try:
serving_host = socket.gethostbyname_ex(socket.gethostname())
except e:
serving_host = e

try:
db_host = db.execute('SELECT @@hostname AS hn').fetchone()['hn']
except e:
db_host = e

log_info_with_request("diagnostics", headers=request.headers, serving_host=serving_host, database_host=db_host)

response_data = {
'request_path': request.headers.get('X-Forwarded-For', 'idfk'),
'serving_host': serving_host,
'database_host': db_host,
}
return make_response(json.dumps(response_data), 200, {'content-type': 'text/plain'})

Check failure

Code scanning / SonarCloud

Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks

<!--SONAR_ISSUE_KEY:AYu0-4MX3xbAiJ_MOB8c-->Change this code to not reflect user-controlled data. <p>See more on <a href="https://sonarcloud.io/project/issues?id=cmu-delphi_delphi-epidata&issues=AYu0-4MX3xbAiJ_MOB8c&open=AYu0-4MX3xbAiJ_MOB8c&pullRequest=1343">SonarCloud</a></p>
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

false positive! i already fixed this in a way suggested by sonarcloud: by changing the content-type