grafana/plugins/marcusolsson-json-datasource/CHANGELOG.md

Changelog

1.3.6 (2023-05-30)

• Chore: Docs update

1.3.5 (2023-04-05)

• Security: Recently, A third party researcher (Alessio Della Libera of Snyk Research Team) discovered and privately disclosed to us a stored XSS vulnerability in the Grafana-maintained marcusolsson-json-datasource plugin also known as “JSON API plugin” .

Users with the editor role could perform a stored XSS attack against other viewers, editors, and administrators by including a specially crafted javascript statement in the field extractor in queries to the marcusolsson-json-datasource plugin. This resulted in XSS against anyone viewing a panel configured to query the datasource with a malicious query.

This vulnerability worked because the marcusolsson-json-datasource plugin uses the jsonpath-plus library to evaluate editor-supplied jsonpath expressions. In its default configuration (which we used), this library is an XSS vector, as the JSONPath spec allows for embedded subexpressions, which jsonpath-plus implements as arbitrary javascript expressions.

In order to mitigate this vulnerability, we now supply a configuration parameter to jsonpath-plus which forbids the evaluation of subexpressions; it is important to note that this change may break existing JSONPath queries that rely on filter or eval expressions.

If your dashboards currently rely on JSONPath queries containing subexpressions, there are a few potential migration paths:

1. For simple queries that use subexpressions for indexing/slicing, it may be possible to rewrite the query without a subexpressions for instance [(@.length-1)] can also be represented as [:-1].
2. For more complex queries, we suggest switching to the jsonata language, which the plugin also supports. This language has similar features to JSONPath, including support for filter expressions (called “predicates” in the documentation).
3. If changing your existing queries isn’t feasible, the community plugin “Infinity” supports JSONPath expressions, including filters and subexpressions if used with the backend parser option. Please note that Infinity is community supported plugin.

1.3.4 (2023-04-04)

• Chore: docs update

1.3.3 (2023-03-20)

• Chore: dependencies update
• Chore: spellcheck added

1.3.2 (2022-10-14)

Full changelog

• Fixed the broken docs and links

1.3.1 (2022-01-24)

Full changelog

Enhancements

• Append suffix to param key to uniquify duplicate param keys #232 (thanks @rejohnst!)
• Added grafana global variables when doing a query using jsonata #223 (thanks @amng!)

Bug fixes

• Certain strings incorrectly identified as dates #202

1.3.0 (2021-09-03)

Full changelog

Enhancements

• Add support for JSONata (#114), a query language similar to JSONPath with support for transformations.

Bug fixes

• Cannot read property 'filter' of undefined (#156)

1.2.1 (2021-06-18)

Full changelog

Enhancements

• Update dependencies, docs, and metadata

1.2.0 (2021-05-18)

Full changelog

Enhancements

• Adding $**isoFrom() and $**isoTo() macros (#115) (thanks @jirkafajfr!)
• Using JSON.stringify instead of toString for object types in parseValue (#111) (thanks @Totalus!)

Bug fixes

• Fix for macros not running in variable queries (#100) (thanks @KensingtonTech!)

1.1.1 (2021-04-17)

Full changelog

Enhancements

• Improve editor styling

Bug fixes

• Fix issue where wrong fields were used when grouping
• Add variable support for aliases

1.1.0 (2021-04-15)

Full changelog

This release introduces an Experimental tab to the query editor. This will be used to let users try out features while they're being developed. Each feature has a link the the GitHub issue where you can share you feedback, before the feature is considered stable.

Enhancements

• Extend variables support to options
• Don't detect time fields from Unix epoch (#82)
• Add params to cache key (#85)
• Add support for field aliases
• Add Experimental section to query editor to test features under development
• Experimental: Group query results by field (#36)
• Experimental: Set display name for metric fields (#36)
• Experimental: Set optional label for variables (#79)

Bug fixes

• Ignore hidden queries (#83)
• New queries don't use default values

1.0.1 (2021-03-05)

Full changelog

Enhancements

• Add annotation support

Bug fixes

• Can't connect to API when URL contains encoded slash (#59)

1.0.0 (2021-03-04)

Full changelog

No noteworthy features or bug fixes in this release. Mostly metadata updates.

0.10.1 (2021-02-27)

Full changelog

Bug fixes

• Undefined cache duration isn't handled
• Query editor tries to update read only property

0.10.0 (2021-02-19)

Full changelog

Enhancements

• Add auto-completion to JSON Path queries

0.9.2 (2021-02-03)

Full changelog

Bug fixes

• Variable queries fail with error (#48)

0.9.1 (2021-02-01)

Full changelog

Bug fixes

• Cannot read property 'toString' of null (#46)

0.9.0 (2021-02-01)

Full changelog

BREAKING CHANGE: Query parameters set by the query editor no longer overrides the data source config, to match how headers are handled in the Grafana proxy. This establishes the convention that any configuration made by an administrator should have higher priority.

IMPORTANT: This release contains many new changes that touches several aspects of the plugin. Make sure that you back up your dashboards before updating your plugin.

This release introduces a new query editor that gives more control of the request.

• Support for both GET and POST methods
• Support for request bodies (when using POST)
• Support for headers

It introduces a new key value editor for query parameters and headers, as well as a Monaco-based editor for editing the request body with syntax highlighting.

This release deprecates the queryString property in the query model, in favor of the new params. The query string config should be backwards-compatible (and forward-compatible) with previous versions, but make sure to back up your dashboard before upgrading.

0.8.0 (2021-01-08)

Full changelog

Enhancements

• Use the refId as the series name
• Add type configuration for queries (#37)

Bug fixes

• Grafana Explore gets stuck when adding a second query (#31)
• Multiple data source queries overwrite each other

0.7.1 (2020-12-07)

Full changelog

Bug fixes

• Falsy values are returned as NaN (#25)

0.7.0 (2020-12-04)

Full changelog

Enhancements

• Add support for custom paths (#24)
• Add epoch time macros (#22)
• Migrate to new form components. This bumps the minimum required Grafana version to 7.3.0

Bug fixes

• Template variable chaining is not working (#23)
• Cannot read property 'length' of null (#21)

0.6.4 (2020-11-30)

Full changelog

Bug fixes

• Fixes an issue where custom query parameters defined in the data source are flipped.

0.6.3 (2020-11-27)

Full changelog

Enhancements

• Updated @grafana dependencies from ^7.0.0 to ^7.3.0
• Improved release process using the new GitHub workflows for Grafana plugins