PublicDashboards: Sanitize metadata from public dashboard queries (#55269)

* Add function to remove metadata from queries

* Add test for RemoveMetadataFromQueryData function

* Remove only custom data and executed query string

* Add sanity check to SanitizeMetadataFromQueryData

pkg/services/publicdashboards/queries/dashboard_queries.go

@@ -1,6 +1,7 @@
 package queries
 
 import (
+	"github.com/grafana/grafana-plugin-sdk-go/backend"
 	"github.com/grafana/grafana/pkg/components/simplejson"
 	"github.com/grafana/grafana/pkg/expr"
 )
@@ -100,3 +101,15 @@ func GetDataSourceUidFromJson(query *simplejson.Json) string {
 
 	return uid
 }
+
+func SanitizeMetadataFromQueryData(res *backend.QueryDataResponse) {
+	for k := range res.Responses {
+		frames := res.Responses[k].Frames
+		for i := range frames {
+			if frames[i].Meta != nil {
+				frames[i].Meta.ExecutedQueryString = ""
+				frames[i].Meta.Custom = nil
+			}
+		}
+	}
+}

pkg/services/publicdashboards/queries/dashboard_queries_test.go

@@ -3,6 +3,8 @@ package queries
 import (
 	"testing"
 
+	"github.com/grafana/grafana-plugin-sdk-go/backend"
+	"github.com/grafana/grafana-plugin-sdk-go/data"
 	"github.com/grafana/grafana/pkg/components/simplejson"
 	"github.com/stretchr/testify/require"
 )
@@ -511,3 +513,55 @@ func TestGroupQueriesByDataSource(t *testing.T) {
 		}`))})
 	})
 }
+
+func TestSanitizeMetadataFromQueryData(t *testing.T) {
+	t.Run("can remove metadata from query", func(t *testing.T) {
+		fakeResponse := &backend.QueryDataResponse{
+			Responses: backend.Responses{
+				"A": backend.DataResponse{
+					Frames: data.Frames{
+						&data.Frame{
+							Name: "1",
+							Meta: &data.FrameMeta{
+								ExecutedQueryString: "Test1",
+								Custom: map[string]string{
+									"test1": "test1",
+								},
+							},
+						},
+						&data.Frame{
+							Name: "2",
+							Meta: &data.FrameMeta{
+								ExecutedQueryString: "Test2",
+								Custom: map[string]string{
+									"test2": "test2",
+								},
+							},
+						},
+					},
+				},
+				"B": backend.DataResponse{
+					Frames: data.Frames{
+						&data.Frame{
+							Name: "3",
+							Meta: &data.FrameMeta{
+								ExecutedQueryString: "Test3",
+								Custom: map[string]string{
+									"test3": "test3",
+								},
+							},
+						},
+					},
+				},
+			},
+		}
+		SanitizeMetadataFromQueryData(fakeResponse)
+		for k := range fakeResponse.Responses {
+			frames := fakeResponse.Responses[k].Frames
+			for i := range frames {
+				require.Empty(t, frames[i].Meta.ExecutedQueryString)
+				require.Empty(t, frames[i].Meta.Custom)
+			}
+		}
+	})
+}

pkg/services/publicdashboards/service/service.go

@@ -215,6 +215,7 @@ func (pd *PublicDashboardServiceImpl) GetQueryDataResponse(ctx context.Context,
 	}
 
 	pd.log.Info("Successfully queried datasources for public dashboard", "datasources", reqDatasources)
+	queries.SanitizeMetadataFromQueryData(res)
 	return res, nil
 }