Repository navigation
fix(database): revert parameterized queries for InfluxDB OSS compatibility - #157
Merged
Merged
Conversation
…ility InfluxDB OSS does not support parameterized Flux queries with the `params` object - this is an InfluxDB Cloud-only feature. The recent security fix (commit 40ebd9e) broke device details for all users running InfluxDB OSS (which is the standard self-hosted deployment). Changes: - Revert QueryWithParams to Query with fmt.Sprintf interpolation - Keep input validation at handler level (defense-in-depth) - Update generateSmartAttributesSubquery to accept wwn parameter - Fix GetZFSPoolMetricsHistory with same approach The WWN/GUID validation added in handlers provides protection against injection attacks, making fmt.Sprintf safe to use. Fixes #155
Merged
8 of 14 tasks
Starosdev
added a commit
that referenced
this pull request
Nov 5, 2026
…for InfluxDB OSS (#1111) (#1124) ## Summary The Btrfs filesystem and ZFS pool detail pages never show their usage history charts on InfluxDB OSS. `GetBtrfsMetricsHistory` and `GetZFSPoolMetricsHistory` used Flux query parameters (`params.uuid`, `params.guid`), which only InfluxDB Cloud supports. OSS rejects every call with `undefined identifier params`, the handlers log a warning, and the API returns `metrics_history: null`. `GetZFSPoolMetricsHistory` was fixed in #157 and regressed one day later: merge `98a1b439` resolved a conflict back to the parameterized form. The Btrfs query was added in May with the same construct. Nothing in CI caught either. ## Type of Change - [x] Bug fix (non-breaking change that fixes an issue) - [ ] New feature (non-breaking change that adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update - [ ] Refactoring (no functional changes) - [x] CI/CD or infrastructure change ## Related Issues Fixes #1111 Related to #155, #157 ## Changes Made - `scrutiny_repository_btrfs.go`, `scrutiny_repository_zfs.go`: validate the identifier inside the repository function (`ValidateUUID` / `ValidateGUID`) and inline it as a `strconv.Quote` Flux string literal via `Query`. This is the pattern `GetMdadmMetricsHistory` and the temperature queries already use. Handler-level validation stays as a second layer. - `.golangci.yml`: enable `forbidigo` with a rule that fails lint on `QueryWithParams` / `QueryRawWithParams`, so a future merge-conflict resolution cannot restore the pattern silently. The message points at #157 and #1111. - `scrutiny_repository_metrics_history_test.go`: a recording `QueryAPI` stub asserts the generated query inlines the quoted id and never contains `params.`, and that an invalid id is rejected before any query runs. ## Testing - [x] I have tested this locally - [x] I have added/updated tests that prove my fix/feature works - [ ] All existing tests pass Local: `go build ./webapp/backend/pkg/database/` and `go vet ./webapp/backend/pkg/database/` pass; `gofmt -l` clean on changed files; pre-commit gofmt and vet hooks pass. The Go test suite and `golangci-lint` run in CI on this PR; I did not run the full suite locally. No Btrfs or ZFS host was available to verify the chart end to end; the issue reporter's reproduction (`metrics_history: null` plus the `undefined identifier params` warning) is the failing path these changes remove. Review: not required (change ships through the develop-to-master promotion PR and a manual release, no direct production effect on merge) ## Follow-up Even with the query working, both charts are capped at the main bucket's 15-day retention: `btrfs_filesystem` and `zfs_pool` are not part of the downsampling tasks, and `lookupBucketName` routes month and year ranges to `_weekly` / `_monthly` buckets that hold no data for them. Not addressed here; an enhancement issue for downsampling the capacity fields and adding a range selector on both detail pages is still to be filed. `beta` carries the same two `params.*` queries (`scrutiny_repository_btrfs.go:215`, `scrutiny_repository_zfs.go:382`) and gets this fix through the next master-into-beta sync. The `forbidigo` rule will flag them there until the sync lands. ## Checklist - [x] My code follows the project's code style - [x] I have performed a self-review of my code - [x] I have commented my code where necessary (particularly complex areas) - [ ] I have updated the documentation if needed - [x] My changes generate no new warnings
Starosdev
pushed a commit
that referenced
this pull request
Nov 5, 2026
## [1.80.0](v1.79.3...v1.80.0) (2026-11-05) ### Features * **btrfs:** notify on degraded filesystems, device errors and scrub errors ([#1127](#1127)) ([36e1e23](36e1e23)), closes [#1110](#1110) * manual release trigger ([44f3e44](44f3e44)) * **notify:** alert when Btrfs or ZFS usage reaches a configurable threshold ([#1133](#1133)) ([6e79118](6e79118)), closes [#1127](#1127) [#1132](#1132) [#1127](#1127) * **zfs:** notify on unhealthy pools, error totals and scrub errors ([#1131](#1131)) ([9c6544c](9c6544c)), closes [#1127](#1127) [#1130](#1130) [#1127](#1127) ### Bug Fixes * **database:** inline validated ids in Btrfs and ZFS history queries for InfluxDB OSS ([#1111](#1111)) ([#1124](#1124)) ([b0a1c69](b0a1c69)), closes [#157](#157) [#155](#155) [#157](#157) [#157](#157) * **mdadm:** honor repeat notifications and retry failed degraded alerts ([#1128](#1128)) ([62f9cef](62f9cef)), closes [#1109](#1109) * **notify:** notify on manufacturer SMART failures at every notify level ([#1126](#1126)) ([5cb3622](5cb3622))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
QueryWithParamstoQuerywithfmt.Sprintfinterpolation for InfluxDB OSS compatibilityparamsobject (Cloud-only feature)Root Cause
Commit
40ebd9eintroduced parameterized queries usingQueryWithParamswithparams.wwnsyntax in Flux queries. This feature is only available in InfluxDB Cloud, not InfluxDB OSS which Scrutiny users run.The error users see:
Changes
scrutiny_repository_device_smart_attributes.goQuerywithfmt.Sprintfscrutiny_repository_zfs.goGetZFSPoolMetricsHistoryto useQuerywithfmt.SprintfSecurity
The WWN/GUID validation added in handlers (
validation.ValidateWWN(),validation.ValidateGUID()) remains in place, providing protection against Flux injection attacks at the API boundary.Test plan
Fixes #155