proxysql

Commit Graph

Author	SHA1	Message	Date
Rene Cannao	3726f09458	fix(test): suppress S4423 with NOSONAR (TLS 1.3 already pinned) The TLS 1.3 minimum pin in the prior commit was the right remediation, but SonarCloud's S4423 matcher fires on any CURLOPT_SSLVERSION line regardless of the configured value. Add NOSONAR with an inline note.	2 months ago
Rene Cannao	f017561aaa	fix(test): bump curl SSL min from TLS 1.2 to TLS 1.3 (SonarCloud S4423) ProxySQL is built against OpenSSL 3.x which supports TLS 1.3; the test client should require it. Clears the last VULNERABILITY-typed issue keeping the 'D Security Rating on New Code' quality gate red.	2 months ago
Rene Cannao	431c65476a	fix(ci): clear SonarCloud security-rating issues on new fedora44 workflows + tsdb test PR #5778 still failed the "D Security Rating on New Code" gate after the SHA-pinning commit, with 27 VULNERABILITY-typed issues remaining: 1. 24 × workflow files (MAJOR, rule S6571): "Move this write permission from workflow level to job level." Moved `permissions: { contents: write, checks: write }` from the top of each of the 12 new fedora44 workflows to each of the two jobs (init_release, build) that actually need them. Same effective permissions; principle-of-least-privilege satisfied per job scope. 2. 3 × test/tap/tests/test_tsdb_api-t.cpp (CRITICAL): - Line 75 (S4423 "Use stronger SSL and TLS versions"): added `CURLOPT_SSLVERSION = CURL_SSLVERSION_TLSv1_2` to pin the test client to TLS 1.2+. Real improvement. - Lines 83/84 (S5527 / S4830 "Enable cert/hostname verification"): `CURLOPT_SSL_VERIFYPEER=0` and `CURLOPT_SSL_VERIFYHOST=0` are by design — the test connects to a localhost proxysql that serves an auto-generated self-signed cert; installing the per-run cert into the system CA store is out of scope for a TAP test. Added NOSONAR + explanatory comment. The remaining 9 CODE_SMELL findings (void*, cognitive complexity, nested control flow in test_tsdb_api-t.cpp and the new libconfig regression test) do not factor into the Security Rating and are left for separate cleanup if desired.	2 months ago
Rene Cannao	043f947915	fix(ci): clear SonarCloud hotspots on new fedora44 workflows + tsdb test Two categories of S security-hotspot findings on PR #5778: 1. LouisBrunner/checks-action@v2.0.0 not pinned to a commit SHA (24 hotspots, lines 90 and 141 of each of the 12 new fedora44 workflow files). Pinned to `@6b626ffbad...` (the commit that v2.0.0 currently points to). The other ~78 workflow files in the repo still use the version-tag form; project-wide SHA pinning is out of scope for this PR. 2. Plain-HTTP literal in test/tap/tests/test_tsdb_api-t.cpp:196 (1 hotspot). The ProxySQL REST API listens on plain HTTP by design; the test must hit the real endpoint, not a TLS variant. Added a clarifying comment and a NOSONAR pragma to suppress the false-positive.	2 months ago
Rene Cannao	798c243fc4	fix(tsdb): serve dashboard from REST API port for same-origin fetch (#5684 ) The TSDB dashboard HTML was served from admin-web_port (default 6080) but its JS issues relative-URL fetches: <script src="/Chart.bundle.js"></script> fetch('/api/tsdb/metrics') fetch('/api/tsdb/query?...') Those URLs resolve against the page origin, so the browser tried to read /api/tsdb/* from :6080 -- but the endpoints live on admin-restapi_port (default 6070). Result: every fetch 404'd and the dashboard rendered "Error loading metrics". Move the dashboard and its Chart.bundle.js asset to the REST API server so the dashboard's relative URLs are same-origin with the endpoints they need. This is the smallest change that makes the feature actually work; backwards-compatibility isn't a constraint since the feature was completely broken at :6080. * lib/ProxySQL_RESTAPI_Server.cpp: register /tsdb and /Chart.bundle.js resources alongside the existing /api/tsdb/* handlers. * lib/ProxySQL_HTTP_Server.cpp: remove the now-redundant /tsdb route. Chart.bundle.js stays here too because other web-port dashboards (e.g. /, /stats) still reference it. * test/tap/tests/test_tsdb_api-t.cpp: rewrite the existing test to pin the new wiring. In particular, parse the live dashboard HTML, extract every src/href/fetch URL, and GET each one against the dashboard's origin -- this assertion fails on the pre-fix code and passes after. Verified locally: bug build fails 5/10 assertions, fixed build passes 10/10. User-facing change: the dashboard URL moves from http://host:admin-web_port/tsdb (broken) to http://host:admin-restapi_port/tsdb (working) The dashboard now requires admin-restapi_enabled=1 instead of admin-web_enabled=1; in practice both were required for the dashboard to be useful since the JS needed the API anyway.	2 months ago
Rene Cannao	60e1d03442	Fix admin connection and authentication in TAP tests Address PR #5470 review feedback: - max_connections_ff-t: Use cl.admin_host for admin connection - test_query_rules_routing-t: Use cl.admin_host for admin connection - test_tsdb_api-t: Use stats:stats credentials for web dashboard, admin credentials for REST API (they use separate auth)	3 months ago
Rene Cannao	ca409366cb	Address review feedback on TSDB tests - Use cl.admin_host instead of cl.host for admin HTTP endpoints - Don't log auth credentials (security issue) - Fail fast when prerequisite SET/LOAD commands fail - Assert on specific test_downsample_metric rows in hourly table	3 months ago
Rene Cannao	809878c253	Fix TSDB TAP tests for Docker-based CI test_tsdb_variables-t: - Add verbose logging for downsampling test - Insert test data with timestamps from 2 hours ago before downsampling - The TSDB downsample logic only processes completed hours, so we need historical data for the test to succeed - Add cleanup of test data after the test test_tsdb_api-t: - Use configurable host from environment (cl.host) instead of hardcoded 127.0.0.1 - Add verbose logging for configuration and test progress - Use proper authentication credentials from command line - Increase retries for dashboard endpoint - Add detailed error messages Fixes #5483	3 months ago
Rene Cannao	ef397f9f1d	Fix TSDB variable patterns and backend monitor runtime source	4 months ago
Rene Cannao	700459f67b	tsdb: address AI code review feedback, fix memory safety and logic bugs Summary of changes: - Fixed allocator mismatches (sqlite3_free vs free) across multiple files. - Converted manual SQL construction to prepared statements for TSDB variables. - Resolved memory leaks in statistics and monitoring loops. - Fixed critical 'LOAD TSDB VARIABLES FROM CONFIG' command mismatch. - Improved command parsing robustness using string searching. - Standardized SQL LIKE patterns with escaped wildcards (\%). - Switched to data-driven variable management in ProxySQL_Statistics. - Improved web dashboard security with URL encoding and const correctness. - Clarified documentation regarding configuration lifecycle and schema names. - Updated TAP tests for better reliability and correct persistence verification.	4 months ago
Rene Cannao	95b46cf21a	tests: add TSDB API and UI verification test - Implemented TAP test for TSDB REST API and Dashboard. - Verified /api/tsdb/{metrics,query,status} endpoints. - Verified /tsdb dashboard accessibility via HTTPS. - Updated Makefile to include new test binary.	4 months ago

11 Commits (fix/pgsql-unix-socket)